Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| beaugunderson | ip-address | >= 10.1.1, < 10.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-ip-address | 10.3.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-ip-address | No fix yet | — |
| Ubuntu 26.04 LTS | node-ip-address | No fix yet | — |
| Ubuntu 24.04 LTS | node-ip-address | No fix yet | — |
| Ubuntu 22.04 LTS | node-ip-address | No fix yet | — |
| Ubuntu 20.04 LTS | node-ip-address | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs24 +4 | 1:24.18.0-5.el10_2 | RHSA-2026:58819 |
| RHEL 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.el10_2 | RHSA-2026:58819 |
| RHEL 9 | nodejs +4 | 1:22.23.1-3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24156+bb41d456 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | npm | 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55601 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee | RHSA-2026:55603 |
| RHEL 8 | nodejs +4 | 1:24.18.0-3.module+el8.10.0+24639+56878497 | RHSA-2026:54371 |
| RHEL 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+24639+56878497 | RHSA-2026:54371 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24562+090c6525 | RHSA-2026:54371 |
| RHEL 8 | npm | 1:11.16.0-1.24.18.0.3.module+el8.10.0+24639+56878497 | RHSA-2026:54371 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497 | RHSA-2026:54371 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.6 EUS | nodejs +4 | 1:22.23.2-1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| RHEL 9.6 EUS | nodejs-nodemon | 3.1.14-2.module+el9.6.0+24789+4011c12f | RHSA-2026:62416 |
| RHEL 9.6 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.6.0+23473+45664c2d | RHSA-2026:62416 |
| RHEL 9.6 EUS | npm | 1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| RHEL 9.6 EUS | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs24 +4 | 1:24.18.0-5.el10_2 | ALSA-2026:58819 |
| AlmaLinux 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.el10_2 | ALSA-2026:58819 |
| AlmaLinux 9 | nodejs +4 | 1:22.23.1-3.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-2.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | npm | 1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce | ALSA-2026:55601 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:55603 |
| AlmaLinux 8 | nodejs +4 | 1:24.18.0-3.module_el8.10.0+4250+09238ed4 | ALSA-2026:54371 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:54371 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:54371 |
| AlmaLinux 8 | npm | 1:11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4 | ALSA-2026:54371 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4 | ALSA-2026:54371 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs24 | 1:24.18.0-5.el10_2 | RLSA-2026:58819 |
| Rocky Linux 9 | nodejs | 1:24.18.0-6.module+el9.8.0+40281+14cc6568 | RLSA-2026:55603 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+40281+14cc6568 | RLSA-2026:55603 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:55603 |
| Rocky Linux 8 | nodejs | 1:24.18.0-3.module+el8.10.0+40277+b1b3f89e | RLSA-2026:54371 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:54371 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:54371 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | nodejs22 | 22.23.2-150700.3.18.1 | SUSE-SU-2026:3557-1 |
| SLES 15 SP7 | nodejs24 | 24.18.1-150700.15.16.1 | SUSE-SU-2026:3520-1 |
| SLES 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES 15 SP6 | nodejs22 | 22.23.2-150600.13.24.1 | SUSE-SU-2026:3521-1 |
| SLES 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | nodejs22 | 22.23.2-160000.1.1 | SUSE-SU-2026:23154-1, SUSE-SU-2026:23130-1 |
| SLES for SAP 16.0 | nodejs24 | 24.18.1-160000.1.1 | SUSE-SU-2026:23155-1, SUSE-SU-2026:23131-1 |
| SLES for SAP 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES for SAP 15 SP6 | nodejs22 | 22.23.2-150600.13.24.1 | SUSE-SU-2026:3521-1 |
| SLES for SAP 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
| SLES 16.0 | nodejs22 | 22.23.2-160000.1.1 | SUSE-SU-2026:23154-1, SUSE-SU-2026:23130-1 |
| SLES 16.0 | nodejs24 | 24.18.1-160000.1.1 | SUSE-SU-2026:23155-1, SUSE-SU-2026:23131-1 |
| SLE HPC 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nodejs24 | 24.21.0-1.1 | openSUSE-SU-2026:12134-1 |
| openSUSE Tumbleweed | nodejs26 | 26.7.0-1.1 | openSUSE-SU-2026:11611-1 |
| openSUSE Leap 16.0 | nodejs22 | 22.23.2-160000.1.1 | openSUSE-SU-2026:21545-1 |
| openSUSE Leap 16.0 | nodejs24 | 24.18.1-160000.1.1 | openSUSE-SU-2026:21546-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs24 +4 | 1:24.18.0-5.0.1.el10_2 | ELSA-2026-58819 |
| Oracle Linux 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.0.1.el10_2 | ELSA-2026-58819 |
| Oracle Linux 9 | nodejs +4 | 1:24.18.0-6.module+el9.8.0+90993+075b4fd6 | ELSA-2026-55603 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+90993+075b4fd6 | ELSA-2026-55603 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+90946+13dc792a | ELSA-2026-55603 |
| Oracle Linux 9 | npm | 1:11.16.0-1.24.18.0.6.module+el9.8.0+90993+075b4fd6 | ELSA-2026-55603 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+90993+075b4fd6 | ELSA-2026-55603 |
| Oracle Linux 8 | nodejs +4 | 1:24.18.0-3.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54371 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54371 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54371 |
| Oracle Linux 8 | npm | 1:11.16.0-1.24.18.0.3.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54371 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54371 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.130.0-r6 | — |
| Wolfi rolling | kubeflow-pipelines-apiserver +1 | 2.17.2-r4 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.17.0-r3 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | langfuse-3-worker | 3.225.1-r2 | — |
| Wolfi rolling | lerna | 9.0.7-r17 | — |
| Wolfi rolling | npm-12 | 12.0.2-r2 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.7.0-r13 | — |
| Wolfi rolling | prism | 5.16.0-r4 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.256.0-r1 | — |
| Wolfi rolling | renovate | 44.23.3-r1 | — |
| Wolfi rolling | saf | 1.7.0-r0 | — |
| Wolfi rolling | sqlpad | 7.5.7-r31 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ip-address | >= 10.1.1, < 10.2.1 | 10.2.1 | GHSA-22jq-vg5j-6vgg |
Advisories 30
- WID-SEC-2026-2816 Red Hat Enterprise Linux (nodejs:24): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:55601 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:58819 Important: nodejs24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:55603 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:54371 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:62416 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:58819 Red Hat Security Advisory: nodejs24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55603 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55601 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54371 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:12134-1 corepack24-24.21.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 15, 2026
- SUSE-SU-2026:3929-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3930-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- openSUSE-SU-2026:11611-1 nodejs26-26.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 27, 2026
- RLSA-2026:58819 Important: nodejs24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:55603 Important: nodejs:24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:54371 Important: nodejs:24 security update Rocky Linux Security Advisories · Aug 26, 2026
- ELSA-2026-58819 Important: nodejs24 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 25, 2026
- ELSA-2026-55603 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 18, 2026
- SUSE-SU-2026:23131-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:23130-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:23155-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:23154-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Aug 14, 2026
- ELSA-2026-54371 Important: nodejs:24 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 14, 2026
- openSUSE-SU-2026:21545-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Aug 12, 2026
- openSUSE-SU-2026:21546-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Aug 12, 2026
- SUSE-SU-2026:3557-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Aug 12, 2026
- SUSE-SU-2026:3520-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Aug 7, 2026
- SUSE-SU-2026:3521-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Aug 7, 2026