CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-105689

The open-source design platform Penpot is vulnerable to Server-Side Request Forgery (SSRF) prior to version 2.18.0 . The root cause lies in the app.util.ssrf/blocked-address? component, which uses Java InetAddress predicates that fail to classify NAT64, 6to4, or Teredo addresses, applying CIDR ch...

CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-104458 YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-104458 YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

GO-2026-6572 Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers NAT64, IPv4-compatible, 6to4 reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve...

SUSE CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

Linux Distros Unpatched Vulnerability : CVE-2026-101910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in...

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Summary No classifier on Address6 recognizes the NAT64 local-use range 64:ff9b:1::/48 RFC 8215. isPrivate, isLoopback, isLinkLocal and their siblings all return false for every address in it, so an internal IPv4 destination written through a local-use NAT64 prefix 64:ff9b:1:7f00:0:100:: for...

NPM: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

NPM: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.2.0, = 10.5.0...

Server-side Request Forgery (SSRF)

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via isPrivate in src/ipv6.ts, which fails to classify addresses in the RFC 8215 NAT64 local-use...

Server-side Request Forgery (SSRF)

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via isPrivate in src/ipv6.ts, which fails to classify addresses in the RFC 8215 NAT64 local-use range...

CVE-2026-101910

A flaw was found in ip-address. The address classification mechanism fails to identify the local-use Network Address Translation NAT64 range as private. A remote attacker can exploit this by submitting an internal address formatted within this IPv6 prefix to an application that relies on the...

DEBIAN-CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

UBUNTU-CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101910

The ip-address JavaScript library (versions 10.2.0 through 10.5.1 ) contains a logic flaw in the Address6 isPrivate classifier located in src/ipv6.ts. Specifically, it fails to recognize the NAT64 local-use range 64:ff9b:1::/48. This allows applications that rely on isPrivate, isLoopback, and isL...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...