Vulnerability · Published May 12, 2026 · Assigned by GitHub_M
CVE-2026-42338ip-address: XSS in Address6 HTML-emitting methods
High 8.1
In plain English
A high-severity cross-site scripting in ip-address from beaugunderson. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 59.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | nodejs | 1:22.23.1-2.el10_2 | ALSA-2026:35842 |
| AlmaLinux:8 | nodejs | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 | ALSA-2026:41947 |
| AlmaLinux:8 | nodejs | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 | ALSA-2026:39868 |
| AlmaLinux:9 | nodejs | 1:22.23.1-1.module_el9.8.0+276+8b329b47 | ALSA-2026:35892 |
| AlmaLinux:9 | nodejs | 1:24.18.0-1.module_el9.8.0+277+61fc613e | ALSA-2026:35891 |
| AlmaLinux:10 | nodejs-devel | 1:22.23.1-2.el10_2 | ALSA-2026:35842 |
| AlmaLinux:8 | nodejs-devel | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 | ALSA-2026:39868 |
| AlmaLinux:8 | nodejs-devel | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 | ALSA-2026:41947 |
| AlmaLinux:9 | nodejs-devel | 1:22.23.1-1.module_el9.8.0+276+8b329b47 | ALSA-2026:35892 |
| AlmaLinux:9 | nodejs-devel | 1:24.18.0-1.module_el9.8.0+277+61fc613e | ALSA-2026:35891 |
| AlmaLinux:10 | nodejs-docs | 1:22.23.1-2.el10_2 | ALSA-2026:35842 |
| AlmaLinux:8 | nodejs-docs | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 | ALSA-2026:41947 |
| AlmaLinux:8 | nodejs-docs | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 | ALSA-2026:39868 |
| AlmaLinux:9 | nodejs-docs | 1:24.18.0-1.module_el9.8.0+277+61fc613e | ALSA-2026:35891 |
| AlmaLinux:9 | nodejs-docs | 1:22.23.1-1.module_el9.8.0+276+8b329b47 | ALSA-2026:35892 |
| AlmaLinux:10 | nodejs-full-i18n | 1:22.23.1-2.el10_2 | ALSA-2026:35842 |
| AlmaLinux:8 | nodejs-full-i18n | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 | ALSA-2026:41947 |
| AlmaLinux:8 | nodejs-full-i18n | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 | ALSA-2026:39868 |
| AlmaLinux:9 | nodejs-full-i18n | 1:22.23.1-1.module_el9.8.0+276+8b329b47 | ALSA-2026:35892 |
| AlmaLinux:9 | nodejs-full-i18n | 1:24.18.0-1.module_el9.8.0+277+61fc613e | ALSA-2026:35891 |
| AlmaLinux:10 | nodejs-libs | 1:22.23.1-2.el10_2 | ALSA-2026:35842 |
| AlmaLinux:8 | nodejs-libs | 1:24.18.0-1.module_el8.10.0+4228+2938bc94 | ALSA-2026:39868 |
| AlmaLinux:8 | nodejs-libs | 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 | ALSA-2026:41947 |
| AlmaLinux:9 | nodejs-libs | 1:24.18.0-1.module_el9.8.0+277+61fc613e | ALSA-2026:35891 |
| AlmaLinux:9 | nodejs-libs | 1:22.23.1-1.module_el9.8.0+276+8b329b47 | ALSA-2026:35892 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3956+47c9ee9f | ALSA-2026:41947 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.3-1.module_el8.10.0+4061+f8ceeab9 | ALSA-2026:39868 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:35892 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.3-3.module_el9.7.0+209+ecf6523e | ALSA-2026:35891 |
| AlmaLinux:10 | nodejs-npm | 1:10.9.8-1.22.23.1.2.el10_2 | ALSA-2026:35842 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:41947 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:39868 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:35891 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+227+12323393 | ALSA-2026:35892 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:39868 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:41947 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:35891 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+227+12323393 | ALSA-2026:35892 |
| AlmaLinux:10 | nodejs24 | 1:24.18.0-1.el10_2 | ALSA-2026:35841 |
| AlmaLinux:10 | nodejs24-devel | 1:24.18.0-1.el10_2 | ALSA-2026:35841 |
| AlmaLinux:10 | nodejs24-docs | 1:24.18.0-1.el10_2 | ALSA-2026:35841 |
| AlmaLinux:10 | nodejs24-full-i18n | 1:24.18.0-1.el10_2 | ALSA-2026:35841 |
| AlmaLinux:10 | nodejs24-libs | 1:24.18.0-1.el10_2 | ALSA-2026:35841 |
| AlmaLinux:10 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.el10_2 | ALSA-2026:35841 |
| AlmaLinux:8 | npm | 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94 | ALSA-2026:39868 |
| AlmaLinux:8 | npm | 1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855 | ALSA-2026:41947 |
| AlmaLinux:9 | npm | 1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47 | ALSA-2026:35892 |
| AlmaLinux:9 | npm | 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e | ALSA-2026:35891 |
| AlmaLinux:8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855 | ALSA-2026:41947 |
| AlmaLinux:9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 | ALSA-2026:35892 |
| AlmaLinux:8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94 | ALSA-2026:39868 |
| AlmaLinux:9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e | ALSA-2026:35891 |
| Debian:12 | node-ip-address | no fix listed | DEBIAN-CVE-2026-42338 |
| Debian:13 | node-ip-address | no fix listed | DEBIAN-CVE-2026-42338 |
| Debian:14 | node-ip-address | 10.2.0-2 | DEBIAN-CVE-2026-42338 |
| Rocky Linux:8 | nodejs | 1:24.18.0-1.module+el8.10.0+40252+a58646bc | RLSA-2026:39868 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.3-1.module+el8.10.0+2084+ab509703 | RLSA-2026:39868 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1667+4a788d89 | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1823+b5789597 | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1924+614dc87f | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1666+930e28e8 | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f | RLSA-2026:41947 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40153+4d595597 | RLSA-2026:35892 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:35892 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40165+d075e3f2 | RLSA-2026:35892 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2 | RLSA-2026:35891 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40171+8fa9c325 | RLSA-2026:39868 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40172+38f6fdd1 | RLSA-2026:39868 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:39868 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40171+8fa9c325 | RLSA-2026:41947 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40172+38f6fdd1 | RLSA-2026:41947 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40165+d075e3f2 | RLSA-2026:35891 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40153+4d595597 | RLSA-2026:35891 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:35892 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40153+4d595597 | RLSA-2026:35892 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40165+d075e3f2 | RLSA-2026:35892 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:35891 |
| Rocky Linux:10 | nodejs22 | 1:22.23.1-2.el10_2 | RLSA-2026:35842 |
| Rocky Linux:10 | nodejs24 | 1:24.18.0-1.el10_2 | RLSA-2026:35841 |
| Ubuntu:22.04:LTS | node-ip-address | no fix listed | UBUNTU-CVE-2026-42338 |
| Ubuntu:24.04:LTS | node-ip-address | no fix listed | UBUNTU-CVE-2026-42338 |
| Ubuntu:25.10 | node-ip-address | no fix listed | UBUNTU-CVE-2026-42338 |
| Ubuntu:26.04:LTS | node-ip-address | no fix listed | UBUNTU-CVE-2026-42338 |
| Ubuntu:26.10 | node-ip-address | no fix listed | UBUNTU-CVE-2026-42338 |
| npm | ip-address | 10.1.1 | GHSA-v2v4-37r5-5v8g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| beaugunderson | ip-address | < 10.1.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-42338 vdb-entry, x_refsource_REDHAT
- RHBZ#2476810 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42338.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:39246 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35842 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35841 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41947 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39868 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:52399 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35892 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35891 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57590 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66545 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66488 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34374 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36754 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33574 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62336 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62335 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41928 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65126 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44263 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44267 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44237 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33155 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33160 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33163 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33173 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33183 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56928 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51200 vendor-advisory, x_refsource_REDHAT