CVE-2026-69192: ip-address Package Allows SSRF and Trust-Boundary Bypass Due to Leading-Zero Octet Misinterpretation
Summary
CVE-2026-69192: Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. Affects ip-address versions < 10.3.1. Fixed in 10.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ip-address package is a widely used library in the Node.js ecosystem that provides utilities for working with IP addresses, including parsing, validation, and manipulation of both IPv4 and IPv6 addresses. It is designed to simplify the handling of IP addresses in applications, ensuring that developers can easily validate and format addresses. However, a vulnerability has been identified in versions up to 10.3.0, which can lead to security issues when handling addresses with leading-zero octets.
Vulnerability Detail
The vulnerability arises from the way the Address4 class in the ip-address package decodes octets with leading zeros. While the Address4 class interprets these octets as decimal values, other components such as the WHATWG URL host parser and network resolvers interpret them as octal values. This discrepancy allows for potential Server-Side Request Forgery (SSRF) attacks, where an attacker can manipulate the input to bypass security checks and access internal resources that should be restricted. For instance, an address like '012.0.0.1' is treated as '12.0.0.1' by the library but resolves to '10.0.0.1' by the resolver, allowing unauthorized access to internal services.
How To Fix
Latest published version: 10.7.4 as of 23 Oct 2026
npm install ip-address@10.7.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.3.1
This is the first release that contains the fix.
npm install ip-address@10.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, implement the following workaround to reject any host with leading-zero octets before parsing:
if (host.split('.').some((octet) => /^0\d/.test(octet))) throw new Error('ambiguous address');
Conclusion
The ip-address package has a significant vulnerability (CVE-2026-69192) that can lead to SSRF and trust-boundary bypass due to the misinterpretation of leading-zero octets. It is crucial to upgrade to version 10.3.1 or later to mitigate this risk. If immediate upgrades are not feasible, implementing the provided workaround can help protect your application.
See every vulnerability recorded for ip-address →
FAQ
CVE-2026-69192 is a vulnerability in the ip-address package that allows for SSRF and trust-boundary bypass due to the misinterpretation of leading-zero octets in IP addresses.
Versions of the ip-address package up to and including 10.3.0 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using your package-lock.json file, you can check for vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without signup.
The vulnerability can lead to SSRF attacks, allowing attackers to access internal services that should be restricted, potentially compromising sensitive data and system integrity.
If you cannot upgrade right away, implement the provided workaround to reject any host with leading-zero octets before parsing to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for ip-address.
