ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-101912 · CVE overview and exploitation status

EUVD-2026-88396

GHSA-j6r3-76f7-8jcv

cve-program · CVE-2026-101912

• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv
• https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28
• https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1

euvd · EUVD-2026-88396

• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv
• https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28
• https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1

nvd · CVE-2026-101912

• https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28
• https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1
• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv

osv · GHSA-j6r3-76f7-8jcv

• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-101912
• https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28
• https://github.com/beaugunderson/ip-address
• https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1

No related changes are available here.