CVE-2026-69192Published
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-69192 · Microsoft / collected KEV context
cve-program · CVE-2026-69192
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr
- https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e
- https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1
nvd · CVE-2026-69192
- https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e
- https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr
osv · GHSA-mwp4-54f8-5fhr
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.