CVE-2026-69198: ip-address Package Vulnerability Allows SSRF Bypass via CIDR Suffix
Summary
CVE-2026-69198: Every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is *shorter* than the reference range's mask. Affects ip-address versions >= 10.1.1, < 10.2.2. Fixed in 10.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ip-address package is a widely used library in the Node.js ecosystem that provides utilities for parsing and validating IP addresses. It supports both IPv4 and IPv6 formats and includes various classification methods to determine the nature of an IP address, such as whether it is private, loopback, or multicast. However, a vulnerability has been identified that allows certain CIDR suffixes to bypass these classification checks, potentially leading to security issues.
Vulnerability Detail
The vulnerability arises from the method 'isInSubnet' in the ip-address package, which incorrectly short-circuits classification checks when the CIDR suffix of an address is shorter than the reference range's mask. This flaw allows an attacker to manipulate the address classification, leading to a Server-Side Request Forgery (SSRF) attack. As a result, internal addresses may be treated as external, allowing unauthorized access to sensitive internal services.
How To Fix
Latest published version: 10.7.4 as of 23 Oct 2026
npm install ip-address@10.7.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.2.2
This is the first release that contains the fix.
npm install ip-address@10.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, you can implement the following workaround to strip the CIDR suffix before classifying the address:
const parsed = new Address4(userInput);
const host = new Address4(parsed.addressMinusSuffix); // classify this one
Conclusion
The ip-address package has a vulnerability (CVE-2026-69198) that can lead to SSRF attacks due to improper address classification when CIDR suffixes are used. It is crucial to upgrade to the patched version or implement the provided workaround to mitigate the risk.
See every vulnerability recorded for ip-address →
FAQ
CVE-2026-69198 is a vulnerability in the ip-address package that allows certain CIDR suffixes to bypass address classification checks, potentially leading to SSRF attacks.
If your application uses the ip-address package for address classification, it may incorrectly classify internal addresses as external, allowing unauthorized access to internal services.
Server-Side Request Forgery (SSRF) is an attack where an attacker can make requests to internal services from a vulnerable server, potentially exposing sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, implement the provided workaround to strip the CIDR suffix before classifying addresses.
References
Related vulnerabilities
Recent vulnerabilities recorded for ip-address.
