{"id":"CVE-2026-69198","sourceIdentifier":"security-advisories@github.com","published":"2026-08-03T20:17:30.107","lastModified":"2026-10-23T21:10:00.157","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2."},{"lang":"es","value":"ip-address es una biblioteca para analizar y manipular direcciones IPv4 e IPv6 en JavaScript. Desde 10.1.1 hasta 10.2.2, cada método de clasificación de uso especial se basa en isInSubnet, que se cortocircuita a falso siempre que la máscara de subred propia de la dirección es más corta que la máscara del rango de referencia. Esa máscara proviene textualmente del sufijo CIDR en la entrada analizada, por lo que añadir un sufijo como /0 suprime la clasificación por completo: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA() y getType() informan que una dirección interna no tiene nada de particular, mientras que correctForm() y address aún devuelven el objetivo interno real. Una aplicación que basa una decisión de límite de confianza de red en estas comprobaciones, por ejemplo, un filtro destinado a bloquear la falsificación de petición del lado del servidor, o SSRF, puede, por lo tanto, tratar un objetivo interno como externo y permitir la petición. La comparación de bits subyacente es correcta, y mask(n) ya devuelve los primeros n bits de la dirección analizada completa independientemente de subnetMask; el defecto es únicamente que la protección de contención se encuentra en la ruta de clasificación. Este problema está solucionado en la versión 10.2.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"beaugunderson","product":"ip-address","versions":[{"version":">= 10.1.1, < 10.2.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-04T17:21:32.083041Z","id":"CVE-2026-69198","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d","source":"security-advisories@github.com"},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2","source":"security-advisories@github.com"},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh","source":"security-advisories@github.com"},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}