CVE-2026-42338 affects the ip-address library for JavaScript, specifically versions before 10.1.1. The vulnerability arises because Address6.group() and Address6.link() methods do not HTML-escape attacker-controlled content before embedding it in returned HTML strings. Additionally, AddressError.parseMessage, used by the Address6 constructor for invalid input, can include unescaped attacker-controlled content. If an application passes untrusted input to Address6 and renders these outputs as HTML, it may be exploited for cross-site scripting. The vulnerability is resolved in version 10.1.1.

The vulnerability allows an attacker to inject malicious HTML or scripts into web pages if the application renders the vulnerable method outputs or error messages as HTML. This can lead to cross-site scripting attacks, potentially compromising user interactions with the affected application. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low complexity, no privileges required, and user interaction needed.

A fix is available in ip-address version 10.1.1. Users and developers should upgrade to version 10.1.1 or later to remediate this vulnerability. The vendor advisory from Red Hat confirms this update and provides patched packages for affected distributions. Until upgraded, applications should avoid rendering the outputs of Address6.group(), Address6.link(), or AddressError.parseMessage as HTML without proper escaping.