Threats tagged 'ghsa-2vr4-cq9g-pvrc'

A Server-Side Request Forgery (SSRF) vulnerability exists in the ip-address JavaScript library versions 10.2.0 through 10.5.0. The issue arises because the Address6 isPrivate classifier does not recognize the NAT64 local-use range 64:ff9b:1::/48, potentially allowing internal IPv4 destinations encoded through this range to be treated as external. This can lead to bypassing network trust boundaries in applications that rely on isPrivate, isLoopback, and isLinkLocal for trust decisions. The vulnerability is fixed in version 10.5.1.