CVE Feed

    Dashboard / CVE / CVE-2026-101910

    CVE-2026-101910

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.

    Published:Sep 28, 2026
    Last Modified:Sep 28, 2026
    EPS:Sep 28, 2026
    EPSS Score:
    CVSS Score:6.9

    Affected Products

    Vendor
    Beaugunderson
    Product
    Ip-address

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-918 Server-Side Request Forgery

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-111997 (CVSS 6.3) — ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and applicatio…
    CVE-2026-101913 (CVSS 6.3) — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, t…
    CVE-2026-101912 (CVSS 6.3) — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, t…
    CVE-2026-101911 (CVSS 6.3) — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, t…
    CVE-2026-69198 (CVSS 6.9) — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until …
    CVE-2026-69192 (CVSS 7.7) — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, A…
    CVE-2026-54272 (CVSS 6.9) — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 th…
    CVE-2026-42338 (CVSS 5.3) — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, A…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High