Threats tagged 'ghsa-rpw4-54j3-4h4q'

The ip-address JavaScript library prior to version 10.5.1 contains an incorrect comparison vulnerability in its IPv6 link-local address detection. The Address6 isLinkLocal method only recognizes the fe80::/64 range instead of the full fe80::/10 range, causing inconsistent classification of certain link-local addresses. This inconsistency can allow an attacker-controlled address within the broader fe80::/10 range to bypass trust-boundary checks relying on isLinkLocal, potentially reaching on-link hosts outside intended boundaries. The issue is fixed in version 10.5.1.