DEBIAN-CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

UBUNTU-CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-69192

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library...

GHSA-MWP4-54F8-5FHR ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Summary Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4'012.0.0.1'...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +129 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =3.2.27, =3.2.27, =0.0.0, =3.2.27, =1.1.0-dev-0d04f54.1, =3.3.0, =0.2.0-beta.4, =0.3.0-beta.3 and more Source cves: CVE-2026-69192 Source advisory: OSV:GHSA-MWP4-54F8-5FHR...

NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.3.0...

Server-side Request Forgery (SSRF)

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through improper handling of IPv4 addresses with leading zeros in the Address4. An attacker can bypass network...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +129 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =3.2.27, =3.2.27, =0.0.0, =3.2.27, =1.1.0-dev-0d04f54.1, =3.3.0, =0.2.0-beta.4, =0.3.0-beta.3 and more Source cves: CVE-2026-69192 Source advisory: SNYK:JS-IPADDRESS-18516623...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +129 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =3.2.27, =3.2.27, =0.0.0, =3.2.27, =1.1.0-dev-0d04f54.1, =3.3.0, =0.2.0-beta.4, =0.3.0-beta.3 and more Source cves: CVE-2026-69192 Source advisory: GHSA-MWP4-54F8-5FHR...

Server-side Request Forgery (SSRF)

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through improper handling of IPv4 addresses with leading zeros in the Address4. An attacker can...

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Summary Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4'012.0.0.1'...

Server-side Request Forgery (SSRF)

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the isInSubnet function. An attacker can bypass network trust-boundary checks by appending a...

@aikidosec/broker-client (>=1.0.47, <=1.0.50), @kirick/ip (0.2.1) +2 more potentially affected by CVE-2026-69198 via ip-address (>=10.1.1, <=10.2.0)

ip-address NPM version =10.1.1, =1.0.47, =0.1.3, =7.6.5-beta.0, =8.0.3 Source cves: CVE-2026-69198 Source advisory: GHSA-4XRF-JV44-H6HH...

@aikidosec/broker-client (>=1.0.47, <=1.0.50), @kirick/ip (0.2.1) +2 more potentially affected by CVE-2026-69198 via ip-address (>=10.1.1, <=10.2.0)

ip-address NPM version =10.1.1, =1.0.47, =0.1.3, =7.6.5-beta.0, =8.0.3 Source cves: CVE-2026-69198 Source advisory: OSV:GHSA-4XRF-JV44-H6HH...

@aikidosec/broker-client (>=1.0.47, <=1.0.50), @kirick/ip (0.2.1) +2 more potentially affected by CVE-2026-69198 via ip-address (>=10.1.1, <=10.2.0)

ip-address NPM version =10.1.1, =1.0.47, =0.1.3, =7.6.5-beta.0, =8.0.3 Source cves: CVE-2026-69198 Source advisory: SNYK:JS-IPADDRESS-18516625...

GHSA-4XRF-JV44-H6HH ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

Summary Every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses...

Server-side Request Forgery (SSRF)

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the isInSubnet function. An attacker can bypass network trust-boundary checks by appending a CIDR suffix with...

ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

Summary Every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses...