CVE-2026-101913
Fixed in a distro release EPSS <1%CVSS 6.3
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.
Products: beaugunderson ip-address
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | ip-address | 10.5.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | actions-runner | 2.337.0-r2 |
| Chainguard | code-server | 4.139.1-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| Chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| Chainguard | graalvm-25-ce-nodejs | 25.0.4.1-r4 |
| Chainguard | homepage | 2.4.0-r1 |
| Chainguard | kibana-9.3 | 9.3.8-r6 |
| Chainguard | langfuse-4-worker | 4.48.0-r0 |
| Chainguard | langfuse-fips-4-worker | 4.48.0-r0 |
| Chainguard | lerna | 10.0.1-r5 |
| Chainguard | librechat | 0.8.7-r16 |
| Chainguard | npm-11 | 11.20.0-r1 |
| Chainguard | npm-12 | 12.1.0-r1 |
| Chainguard | opensearch-dashboards-3 | 3.9.0-r1 |
| Chainguard | prism | 5.16.0-r14 |
| Chainguard | pulumi-language-nodejs | 3.265.0-r2 |
| Chainguard | renovate | 44.131.0-r1 |
| Chainguard | renovate | 44.133.0-r0 |
| Chainguard | sqlpad | 7.5.7-r42 |
| Chainguard | unleash | 8.2.0-r4 |
| Chainguard | unleash-fips | 8.2.0-r1 |
| Chainguard | unleash-proxy | 1.4.19-r13 |
| Chainguard | wazuh-dashboard | 4.14.8-r5 |
| Chainguard | wazuh-dashboard-fips | 4.14.8-r6 |
| Chainguard | wazuh-dashboard-security-plugin | 4.14.8-r5 |
| Chainguard | wazuh-dashboard-security-plugin-fips | 4.14.8-r6 |
| Debian 12 | node-ip-address | no fix |
| Debian 13 | node-ip-address | no fix |
| Debian 14 | node-ip-address | 10.7.2-1 |
| Ubuntu 20.04 LTS | node-ip-address | no fix |
| Ubuntu 22.04 LTS | node-ip-address | no fix |
| Ubuntu 24.04 LTS | node-ip-address | no fix |
| Ubuntu 26.04 LTS | node-ip-address | no fix |
| Ubuntu 26.10 | node-ip-address | no fix |
| Wolfi | code-server | 4.139.1-r1 |
| Wolfi | lerna | 10.0.1-r5 |
| Wolfi | npm-12 | 12.1.0-r1 |
| Wolfi | opensearch-dashboards-3 | 3.9.0-r1 |
| Wolfi | prism | 5.16.0-r14 |
| Wolfi | pulumi-language-nodejs | 3.265.0-r2 |
| Wolfi | renovate | 44.131.0-r1 |
| Wolfi | renovate | 44.133.0-r0 |
| Wolfi | sqlpad | 7.5.7-r42 |