Vulnerability · Published Sep 28, 2026 · Assigned by GitHub_M
CVE-2026-101910ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
Medium 6.9
In plain English
A medium-severity server-side request forgery in ip-address from beaugunderson. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | node-ip-address | 10.7.2-1 | DEBIAN-CVE-2026-101910 |
| Ubuntu:22.04:LTS | node-ip-address | no fix listed | UBUNTU-CVE-2026-101910 |
| Ubuntu:24.04:LTS | node-ip-address | no fix listed | UBUNTU-CVE-2026-101910 |
| Ubuntu:26.04:LTS | node-ip-address | no fix listed | UBUNTU-CVE-2026-101910 |
| Ubuntu:26.10 | node-ip-address | no fix listed | UBUNTU-CVE-2026-101910 |
| npm | ip-address | 10.5.1 | GHSA-2vr4-cq9g-pvrc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| beaugunderson | ip-address | >= 10.2.0, < 10.5.1 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N