The ip-address library for JavaScript, used for parsing and manipulating IPv4 and IPv6 addresses, has a vulnerability in versions 10.1.1 through 10.2.1 where all special-use classification methods rely on the isInSubnet function. This function short-circuits to false if the address's subnet mask is shorter than the reference range's mask, which can be manipulated by appending a CIDR suffix such as /0. Consequently, methods like isLoopback(), isPrivate(), and others incorrectly report internal addresses as external. This can cause applications relying on these checks for network trust-boundary decisions, such as SSRF filters, to mistakenly allow requests to internal addresses. The underlying bit comparison logic is correct, but the containment guard in the classification path is flawed. The vulnerability is resolved in version 10.2.2.

Applications using affected versions of the ip-address library may incorrectly classify internal IP addresses as external, potentially allowing unauthorized access or bypassing security controls such as SSRF filters. This misclassification could lead to sensitive internal resources being exposed or accessed by attackers. There are no known exploits in the wild at this time.

A fix is available in ip-address version 10.2.2. Users should upgrade to version 10.2.2 or later to resolve this vulnerability. Since the vendor advisory does not provide additional remediation details, upgrading to the fixed version is the recommended action.