Threats affecting pkg:npm/ip-address

The ip-address JavaScript library prior to version 10.5.1 contains an incorrect comparison vulnerability in its IPv6 link-local address detection. The Address6 isLinkLocal method only recognizes the fe80::/64 range instead of the full fe80::/10 range, causing inconsistent classification of certain link-local addresses. This inconsistency can allow an attacker-controlled address within the broader fe80::/10 range to bypass trust-boundary checks relying on isLinkLocal, potentially reaching on-link hosts outside intended boundaries. The issue is fixed in version 10.5.1.

The ip-address JavaScript library versions prior to 10.7.1 contain a vulnerability in the isInSubnet and isHostInSubnet methods. These methods perform subnet containment checks by comparing masked binary strings without verifying that both addresses belong to the same IP family (IPv4 vs IPv6). This flaw can cause cross-family containment checks to incorrectly classify an IP address as within a subnet when it is not, potentially leading to incorrect allowlist or denylist decisions. The issue is fixed in version 10.7.1.

CVE-2026-101911 is a medium severity vulnerability in the JavaScript ip-address library before version 10.7.1. It involves uncontrolled resource consumption due to unbounded string input in the Address6 constructor, Address6.isValid, and related parsing code. Large attacker-controlled inputs can cause synchronous stalls, high memory usage, invalid string length exceptions, and process termination. The issue is fixed in version 10.7.1.

A Server-Side Request Forgery (SSRF) vulnerability exists in the ip-address JavaScript library versions 10.2.0 through 10.5.0. The issue arises because the Address6 isPrivate classifier does not recognize the NAT64 local-use range 64:ff9b:1::/48, potentially allowing internal IPv4 destinations encoded through this range to be treated as external. This can lead to bypassing network trust boundaries in applications that rely on isPrivate, isLoopback, and isLinkLocal for trust decisions. The vulnerability is fixed in version 10.5.1.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.

The ip-address JavaScript library prior to version 10.3.1 improperly validates input when parsing IPv4 addresses with octets that have leading zeros. This causes a mismatch between the library's interpretation and standard network parsers, potentially leading to incorrect classification of internal versus external IP addresses. This can affect security decisions such as Server-Side Request Forgery (SSRF) protections. The issue is fixed in version 10.3.1.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.