The ip-address library for JavaScript improperly validates input related to subnet masks in versions >=10.1.1 <10.2.2. The classification methods for special-use IP addresses rely on isInSubnet, which short-circuits to false if the address's subnet mask is shorter than the reference range's mask. Since the mask is taken verbatim from the CIDR suffix, an attacker can append a suffix like /0 to suppress classification. This causes methods like isLoopback(), isPrivate(), and others to misclassify internal addresses as external, potentially bypassing network trust-boundary checks such as SSRF filters. The underlying bit comparison logic is correct, but the containment guard is misplaced in the classification path. The vulnerability is resolved in version 10.2.2.

Applications using affected versions of the ip-address library that rely on its special-use classification methods for security decisions may incorrectly treat internal IP addresses as external. This can lead to bypassing security controls such as SSRF protections, potentially allowing unauthorized internal network access or data exposure. There are no known exploits in the wild at this time.

Upgrade the ip-address library to version 10.2.2 or later, where this vulnerability is fixed. Patch status is not explicitly stated but the issue is resolved in 10.2.2. Until upgraded, avoid relying solely on the affected classification methods for critical network trust-boundary decisions.