MEDIUMnpm
GHSA-22jq-vg5j-6vgg· CVE-2026-54272ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
Modified: 9/10/2026
package
npm/ip-address
pkg:npm/ip-address
MEDIUMnpm
GHSA-2vr4-cq9g-pvrc· CVE-2026-101910ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
Modified: 9/28/2026
MEDIUMnpm
GHSA-4xrf-jv44-h6hh· CVE-2026-69198ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
Modified: 9/10/2026
HIGHnpm
GHSA-mwp4-54f8-5fhr· CVE-2026-69192ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
Modified: 9/10/2026
MEDIUMnpm
GHSA-rpw4-54j3-4h4q· CVE-2026-101913ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
Modified: 9/28/2026
MEDIUMnpm
GHSA-v2v4-37r5-5v8g· CVE-2026-42338ip-address has XSS in Address6 HTML-emitting methods
Modified: 9/10/2026