{"id":"EUVD-2026-88394","enisaUuid":"78967670-42de-3994-bfd5-36fc2e645dc9","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.","datePublished":"Sep 28, 2026, 5:45:27 PM","dateUpdated":"Sep 28, 2026, 6:12:34 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc\nhttps://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8\nhttps://github.com/beaugunderson/ip-address/releases/tag/v10.5.1\n","aliases":"CVE-2026-101910\nGHSA-2vr4-cq9g-pvrc\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"4c23a542-908e-3841-aca0-44816e02e28a","product":{"name":"ip-address","vendor":{"name":"beaugunderson"}},"product_version":"10.2.0, \u003c 10.5.1"}],"enisaIdVendor":[{"id":"28894dc4-ca35-3e78-a216-29e9bfee4ec1","vendor":{"name":"beaugunderson"}}],"enisaIdVulnerability":[{"id":"b2da7251-d953-3aba-b2d0-0639fa8a0e17","vulnerability":{"id":"CVE-2026-101910","description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.","datePublished":"Sep 28, 2026, 5:45:27 PM","dateUpdated":"Sep 28, 2026, 6:12:34 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc\nhttps://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8\nhttps://github.com/beaugunderson/ip-address/releases/tag/v10.5.1\n","enisa_id":"EUVD-2026-88394\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Nov 11, 2026, 7:20:46 AM","vulnerabilityProduct":[{"id":"abff8d24-3ebd-3256-a85f-9794afd85ec1","product":{"name":"ip-address","vendor":{"name":"beaugunderson"}},"product_version":"10.2.0, \u003c 10.5.1"}],"vulnerabilityVendor":[{"id":"3d225d96-8a2a-3051-a034-bac3c00d12b9","vendor":{"name":"beaugunderson"}}]}},{"id":"ca1e60d0-6fae-3b79-8860-ccb2b708efc1","vulnerability":{"id":"GHSA-2vr4-cq9g-pvrc","description":"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass","datePublished":"Sep 28, 2026, 8:43:03 PM","dateUpdated":"Sep 28, 2026, 8:43:03 PM","baseScore":0.0,"references":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101910\nhttps://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8\nhttps://github.com/beaugunderson/ip-address\nhttps://github.com/beaugunderson/ip-address/releases/tag/v10.5.1\n","enisa_id":"EUVD-2026-88394\n","aliases":"GHSA-2vr4-cq9g-pvrc\nCVE-2026-101910\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}