CVE-2026-69198

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-69198
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-69198.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-69198
Aliases
Downstream
CGA (81)
CLEANSTART (34)
CLSA (2)
DEBIAN (1)
ECHO (1)
MINI (21)
RHSA (2)
UBUNTU (1)
Published
2026-08-03T19:59:05Z
Modified
2026-10-25T02:34:47Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
Details

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69198.json"
}
References

Affected packages

Git / github.com/beaugunderson/ip-address

Affected ranges

Type
GIT
Repo
https://github.com/beaugunderson/ip-address
Events
Introduced
c3fcb1fd1b093ffca343280e134a73ab413ad068
Fixed
f7314db5dd313c211bdc9036901bb67e9b6eafdd
Fixed
488fe9bc7c35363b4b090494fc38c266d217740d
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "10.1.1"
                },
                {
                    "fixed": "10.2.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "488fe9bc7c35363b4b090494fc38c266d217740d"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v10.2.2",
            "range": [
                {
                    "fixed": "f7314db5dd313c211bdc9036901bb67e9b6eafdd"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v10.*
v10.1.1
v10.2.0
v10.2.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-69198.json"