CVE-2026-101910
Fixed in a distro release EPSS <1%CVSS 6.9
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.
Products: beaugunderson ip-address
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | ip-address | 10.5.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | actions-runner | 2.337.0-r2 |
| Chainguard | code-server | 4.139.1-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| Chainguard | graalvm-25-ce-nodejs | 25.0.4.1-r4 |
| Chainguard | homepage | 2.4.0-r1 |
| Chainguard | kibana-9.3 | 9.3.8-r6 |
| Chainguard | langfuse-4-worker | 4.48.0-r0 |
| Chainguard | langfuse-fips-4-worker | 4.48.0-r0 |
| Chainguard | lerna | 10.0.1-r5 |
| Chainguard | librechat | 0.8.7-r16 |
| Chainguard | npm-11 | 11.20.0-r1 |
| Chainguard | npm-12 | 12.1.0-r1 |
| Chainguard | opensearch-dashboards-3 | 3.9.0-r1 |
| Chainguard | prism | 5.16.0-r14 |
| Chainguard | pulumi-language-nodejs | 3.265.0-r2 |
| Chainguard | renovate | 44.131.0-r1 |
| Chainguard | renovate | 44.133.0-r0 |
| Chainguard | sqlpad | 7.5.7-r42 |
| Chainguard | unleash | 8.2.0-r4 |
| Chainguard | unleash-fips | 8.2.0-r1 |
| Chainguard | unleash-proxy | 1.4.19-r13 |
| Chainguard | wazuh-dashboard | 4.14.8-r5 |
| Chainguard | wazuh-dashboard-fips | 4.14.8-r6 |
| Chainguard | wazuh-dashboard-security-plugin | 4.14.8-r5 |
| Chainguard | wazuh-dashboard-security-plugin-fips | 4.14.8-r6 |
| Debian 12 | node-ip-address | no fix |
| Debian 13 | node-ip-address | no fix |
| Debian 14 | node-ip-address | 10.7.2-1 |
| Ubuntu 20.04 LTS | node-ip-address | no fix |
| Ubuntu 22.04 LTS | node-ip-address | no fix |
| Ubuntu 24.04 LTS | node-ip-address | no fix |
| Ubuntu 26.04 LTS | node-ip-address | no fix |
| Ubuntu 26.10 | node-ip-address | no fix |
| Wolfi | code-server | 4.139.1-r1 |
| Wolfi | lerna | 10.0.1-r5 |
| Wolfi | npm-12 | 12.1.0-r1 |
| Wolfi | opensearch-dashboards-3 | 3.9.0-r1 |
| Wolfi | prism | 5.16.0-r14 |
| Wolfi | pulumi-language-nodejs | 3.265.0-r2 |
| Wolfi | renovate | 44.133.0-r0 |
| Wolfi | renovate | 44.131.0-r1 |
| Wolfi | sqlpad | 7.5.7-r42 |