NPM: ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

🗓️ 29 Sep 2026 23:46:52Reported by PatchstackType

In `ip-address`, `isInSubnet()` and `isHostInSubnet()` permit out-of-range addresses.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2026-101912	15 Sep 202604:15	–	circl
CVE	CVE-2026-101912	28 Sep 202617:48	–	cve
Cvelist	CVE-2026-101912 ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range	28 Sep 202617:48	–	cvelist
Debian CVE	CVE-2026-101912	28 Sep 202617:48	–	debiancve
EUVD	EUVD-2026-88396	28 Sep 202617:48	–	euvd
Github Security Blog	ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range	29 Sep 202623:46	–	github
NVD	CVE-2026-101912	28 Sep 202618:17	–	nvd
OSV	DEBIAN-CVE-2026-101912	28 Sep 202618:17	–	osv
OSV	GHSA-J6R3-76F7-8JCV ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range	29 Sep 202623:46	–	osv
OSV	UBUNTU-CVE-2026-101912	29 Sep 202600:00	–	osv

Vulners

Node

npm ip-addressRange≤10.7.0

Source	Link
github	www.github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-101912
github	www.github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28
github	www.github.com/beaugunderson/ip-address/releases/tag/v10.7.1
github	www.github.com/advisories/GHSA-j6r3-76f7-8jcv

29 Sep 2026 23:46Current

5.8Medium risk

Vulners AI Score5.8

CVSS 46.3

EPSS0.0037

SSVC