The ip-address library for JavaScript versions before 10.3.1 contains an input validation flaw where Address4 incorrectly interprets octets with leading zeros as decimal rather than octal. This differs from the behavior of the WHATWG URL host parser, inet_aton, and getaddrinfo, which interpret leading zeros as octal. Consequently, the library and network stack disagree on the actual IP address, causing functions like isPrivate(), isLoopback(), and correctForm() to return incorrect results. This discrepancy can lead to security boundary misclassifications, for example allowing SSRF attacks by misclassifying internal IPs as external. The vulnerability is resolved in version 10.3.1.

Applications relying on ip-address library versions prior to 10.3.1 for IP address parsing and network trust decisions may incorrectly classify IP addresses due to inconsistent parsing of octets with leading zeros. This can result in security controls such as SSRF filters failing to block internal network requests, potentially exposing internal resources to unauthorized access. The vulnerability affects all consumers of the Address4 parsing and related classification functions.

Upgrade the ip-address library to version 10.3.1 or later, where this input validation issue is fixed. No other mitigations are specified or required once the library is updated.