CVE-2026-69198
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.
INFO
Published Date :
Aug. 3, 2026, 8:17 p.m.
Last Modified :
Oct. 23, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update the ip-address library to version 10.2.2.
- Verify the address classification methods.
- Review network trust-boundary decisions.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-69198.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-69198 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-69198
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-69198 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-69198 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: ip-address de beaugunderson, Description: ip-address es una biblioteca para analizar y manipular direcciones IPv4 e IPv6 en JavaScript. Desde 10.1.1 hasta 10.2.2, cada método de clasificación de uso especial se basa en isInSubnet, que se cortocircuita a falso siempre que la máscara de subred propia de la dirección es más corta que la máscara del rango de referencia. Esa máscara proviene textualmente del sufijo CIDR en la entrada analizada, por lo que añadir un sufijo como /0 suprime la clasificación por completo: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA() y getType() informan que una dirección interna no tiene nada de particular, mientras que correctForm() y address aún devuelven el objetivo interno real. Una aplicación que basa una decisión de límite de confianza de red en estas comprobaciones, por ejemplo, un filtro destinado a bloquear la falsificación de petición del lado del servidor, o SSRF, puede, por lo tanto, tratar un objetivo interno como externo y permitir la petición. La comparación de bits subyacente es correcta, y mask(n) ya devuelve los primeros n bits de la dirección analizada completa independientemente de subnetMask; el defecto es únicamente que la protección de contención se encuentra en la ruta de clasificación. Este problema está solucionado en la versión 10.2.2. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 04, 2026
Action Type Old Value New Value Added Reference https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh Added SSVC {'id': 'CVE-2026-69198', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-04T17:21:32.083041Z'} -
New CVE Received by [email protected]
Aug. 03, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'beaugunderson', 'product': 'ip-address', 'versions': [{'status': 'affected', 'version': '>= 10.1.1, < 10.2.2'}]}] Added Description ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-20 Added CWE CWE-918 Added Reference https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d Added Reference https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2 Added Reference https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh