CVE-2026-101910: ip-address Package Vulnerability Allowing SSRF and Trust-Boundary Bypass

Background

The ip-address package is a widely used library in the Node.js ecosystem that provides utilities for working with IP addresses, including IPv4 and IPv6. It offers functionalities such as address validation, classification, and manipulation. However, a vulnerability has been identified that affects versions 10.2.0 to 10.5.0, allowing for potential Server-Side Request Forgery (SSRF) attacks due to improper classification of NAT64 local-use addresses.

Vulnerability Detail

The vulnerability arises from the ip-address package failing to recognize the NAT64 local-use range 64:ff9b:1::/48 as a private address. As a result, methods like isPrivate(), isLoopback(), and isLinkLocal() return false for addresses within this range. This misclassification can lead to SSRF attacks, where an attacker can exploit the application to make requests to internal services that should be blocked, effectively bypassing security measures.

npm install ip-address@10.5.1

Workaround

If you cannot upgrade immediately, you can implement a workaround by directly checking if an address falls within the NAT64 local-use range. Here is a code snippet to help you with this check:

const { Address6 } = require('ip-address');
const NAT64_LOCAL_USE = new Address6('64:ff9b:1::/48');
const host = 'your-ip-address-here';
const localUse = new Address6(host).isHostInSubnet(NAT64_LOCAL_USE);
if (localUse) {
  console.log('Address is in the NAT64 local-use range.');
} else {
  console.log('Address is not in the NAT64 local-use range.');
}

Conclusion

The ip-address package has a vulnerability that can lead to SSRF attacks due to misclassification of NAT64 local-use addresses. It is crucial to upgrade to the patched version or implement the workaround to mitigate the risk. Regular monitoring using tools like Vulert can help maintain the security of your applications.

See every vulnerability recorded for ip-address →

FAQ