Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| beaugunderson | ip-address | < 10.3.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-ip-address | 10.3.1-1 | — |
| Debian 13 | node-ip-address | No fix yet | — |
| Debian 12 | node-ip-address | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-ip-address | No fix yet | — |
| Ubuntu 26.04 LTS | node-ip-address | No fix yet | — |
| Ubuntu 24.04 LTS | node-ip-address | No fix yet | — |
| Ubuntu 22.04 LTS | node-ip-address | No fix yet | — |
| Ubuntu 20.04 LTS | node-ip-address | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs +5 | 1:22.23.1-6.el10_2 | RHSA-2026:55541 |
| RHEL 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.el10_2 | RHSA-2026:55541 |
| RHEL 10 | nodejs24 +4 | 1:24.18.0-5.el10_2 | RHSA-2026:58819 |
| RHEL 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.el10_2 | RHSA-2026:58819 |
| RHEL 10 | rh-podman-desktop | 1.1.2-1.el10_2 | RHSA-2026:57590 |
| RHEL 9 | nodejs +4 | 1:22.23.1-3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24156+bb41d456 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | npm | 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55601 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee | RHSA-2026:55603 |
| RHEL 8 | nodejs +4 | 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+24639+56878497 | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24500+8eb51621 | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | npm | 1:10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e | RHSA-2026:54530 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497 | RHSA-2026:54371 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | nodejs +5 | 1:22.23.2-1.el10_0 | RHSA-2026:64817 |
| RHEL 10.0 EUS | nodejs-npm | 1:10.9.8-1.22.23.2.1.el10_0 | RHSA-2026:64817 |
| RHEL 9.6 EUS | nodejs +4 | 1:22.23.2-1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| RHEL 9.6 EUS | nodejs-nodemon | 3.1.14-2.module+el9.6.0+24789+4011c12f | RHSA-2026:62416 |
| RHEL 9.6 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.6.0+23473+45664c2d | RHSA-2026:62416 |
| RHEL 9.6 EUS | npm | 1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| RHEL 9.6 EUS | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.6-0.4.1.hum1 | RHSA-2026:50969, RHSA-2026:50854 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.1-0.5.2.hum1 | RHSA-2026:50956, RHSA-2026:50826 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs +4 | 1:22.23.1-6.el10_2 | ALSA-2026:55541 |
| AlmaLinux 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.el10_2 | ALSA-2026:55541 |
| AlmaLinux 10 | nodejs24 +4 | 1:24.18.0-5.el10_2 | ALSA-2026:58819 |
| AlmaLinux 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.el10_2 | ALSA-2026:58819 |
| AlmaLinux 9 | nodejs +4 | 1:22.23.1-3.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-2.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | npm | 1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce | ALSA-2026:55601 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:55603 |
| AlmaLinux 8 | nodejs +4 | 1:22.23.1-3.module_el8.10.0+4251+b427b8a5 | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | npm | 1:10.9.8-1.22.23.1.3.module_el8.10.0+4251+b427b8a5 | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module_el8.10.0+4251+b427b8a5 | ALSA-2026:54530 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4 | ALSA-2026:54371 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs22 | 1:22.23.1-6.el10_2 | RLSA-2026:55541 |
| Rocky Linux 10 | nodejs24 | 1:24.18.0-5.el10_2 | RLSA-2026:58819 |
| Rocky Linux 9 | nodejs | 1:22.23.1-3.module+el9.8.0+40280+057606e8 | RLSA-2026:55603, RLSA-2026:55601 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+40264+d9b257bb | RLSA-2026:55603, RLSA-2026:55601 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:55603, RLSA-2026:55601 |
| Rocky Linux 8 | nodejs | 1:22.23.1-3.module+el8.10.0+40278+50b003a3 | RLSA-2026:54530, RLSA-2026:54371 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:54530, RLSA-2026:54371 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:54530, RLSA-2026:54371 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES for SAP 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
| SLE HPC 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs24 +4 | 1:24.22.0-1.amzn2023.0.1 | ALAS2023-2026-3297 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.0.1.amzn2023.0.1 | ALAS2023-2026-3297 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.0.1.amzn2023.0.1 | ALAS2023-2026-3297 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.23.1-6.0.1.el10_2 | ELSA-2026-55541 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.0.1.el10_2 | ELSA-2026-55541 |
| Oracle Linux 10 | nodejs24 +4 | 1:24.18.0-5.0.1.el10_2 | ELSA-2026-58819 |
| Oracle Linux 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.0.1.el10_2 | ELSA-2026-58819 |
| Oracle Linux 9 | nodejs +4 | 1:22.23.1-3.module+el9.8.0+90991+73acc950 | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+90991+73acc950 | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+90946+13dc792a | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | npm | 1:10.9.8-1.22.23.1.3.module+el9.8.0+90991+73acc950 | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+90991+73acc950 | ELSA-2026-55601 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+90993+075b4fd6 | ELSA-2026-55603 |
| Oracle Linux 8 | nodejs +4 | 1:22.23.1-3.module+el8.10.0+90989+141244df | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.10.0+90968+e271b286 | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | npm | 1:10.9.8-1.22.23.1.3.module+el8.10.0+90989+141244df | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el8.10.0+90989+141244df | ELSA-2026-54530 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54371 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.130.0-r6 | — |
| Wolfi rolling | kubeflow-pipelines-apiserver +1 | 2.17.2-r4 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.17.0-r3 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | langfuse-3-worker | 3.225.1-r2 | — |
| Wolfi rolling | lerna | 9.0.7-r17 | — |
| Wolfi rolling | npm-12 | 12.0.2-r2 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.7.0-r13 | — |
| Wolfi rolling | prism | 5.16.0-r4 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.256.0-r1 | — |
| Wolfi rolling | renovate | 44.23.3-r1 | — |
| Wolfi rolling | saf | 1.7.0-r0 | — |
| Wolfi rolling | sqlpad | 7.5.7-r31 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ip-address | < 10.3.1 | 10.3.1 | GHSA-mwp4-54f8-5fhr |
Advisories 38
- WID-SEC-2026-2816 Red Hat Enterprise Linux (nodejs:24): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- ALSA-2026:55601 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:58819 Important: nodejs24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:55541 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:55603 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:54371 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:54530 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALAS2023-2026-3297 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- RHSA-2026:64817 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:62416 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:58819 Red Hat Security Advisory: nodejs24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:57590 Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55603 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55601 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55541 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54530 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54371 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50826 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50969 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:50956 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:50854 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- SUSE-SU-2026:3929-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3930-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- RLSA-2026:58819 Important: nodejs24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:55603 Important: nodejs:24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:55601 Important: nodejs:22 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:54371 Important: nodejs:24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:54530 Important: nodejs:22 security update Rocky Linux Security Advisories · Aug 26, 2026
- ELSA-2026-58819 Important: nodejs24 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 25, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
- RLSA-2026:55541 Important: nodejs22 security update Rocky Linux Security Advisories · Aug 18, 2026
- ELSA-2026-55603 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 18, 2026
- ELSA-2026-55601 Important: nodejs:22 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 18, 2026
- ELSA-2026-55541 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
- ELSA-2026-54530 Important: nodejs:22 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 14, 2026
- ELSA-2026-54371 Important: nodejs:24 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 14, 2026