ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

SSRF (Server-Side Request Forgery) ip-address Dependency in Jira Service Management Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 11.2.0 and 11.3.0 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

SSRF (Server-Side Request Forgery) ip-address Dependency in Jira Software Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 11.2.0 and 11.3.0 of Jira Software Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...

CVE-2026-69192

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-69198

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing CIDR suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such a...

Malicious code in shift-sdk-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aca555e012d36b30d9ffe3d0f8acdca7ba67298a87ea02ea9d32731e8f2a748 [email protected] registers a postinstall script that runs dist/recon.js on npm install. The script collects hostname, username, SUDOUSER, home...

Malicious code in wallet-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc85c0238f90672b0cc329cae3487061924ed5a6458644a97cd90a830ace807 index.js exports a getPlugin function that issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/ and passes t...

Linux Distros Unpatched Vulnerability : CVE-2026-69198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is...

GHSA-C6XH-WV4J-PPV5 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Summary Flowise's HTTP security module httpSecurity.ts fails to normalize IPv4-mapped IPv6 addresses e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254 before checking them against the deny list. Due to an ipaddr.js kind mismatch ipv6 vs ipv4, all IPv4 CIDR deny rules are silently skipped for...

CLSA-2026-1782694761 TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 9.0.5-tuxcare.1...

Security Bulletin:IP-Address Library Vulnerability: XSS Risk with Untrusted Input Rendering and HTML Escaping Issues

Summary ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group and Address6.link do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage emitted by the...

Linux Distros Unpatched Vulnerability : CVE-2026-69192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading ze...

UBUNTU-CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

DEBIAN-CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

UBUNTU-CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.3.0...

Server-side Request Forgery (SSRF)

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through improper handling of IPv4 addresses with leading zeros in the Address4. An attacker can...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +126 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =1.0.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =1.0.118 and more Source cves: CVE-2026-69192 Source advisory: SNYK:JS-IPADDRESS-18516623...