CVE-2026-54272
Received Received - Intake

SSRF via IPv4-Mapped/NAT64 Misclassification in ip-address

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-54272
EUVD
EUVD-2026-49375

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
beaugunderson ip-address From 10.1.1 (inc) to 10.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the ip-address library (versions 10.1.1 to 10.2.0) allows Server-Side Request Forgery (SSRF) due to misclassification of IPv4-mapped and NAT64 IPv6 addresses. The library incorrectly labels these addresses as Global unicast instead of their true type, bypassing security checks like loopback or multicast detection. This enables attackers to trick the system into making unintended network requests.

Detection Guidance

This vulnerability can be detected by checking if your system uses the vulnerable versions (10.1.1 to 10.2.0) of the ip-address library. Inspect package.json or dependency files for the library version. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to send crafted requests to internal systems or bypass network restrictions, potentially accessing sensitive data or services. For IPv4-mapped addresses, this is exploitable on any dual-stack host. For NAT64, exploitation requires a NAT64/DNS64 gateway in the network.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations if exploited, potentially resulting in fines or legal consequences.

Mitigation Strategies

Upgrade the ip-address library to version 10.2.1 or later to address the SSRF vulnerability. If upgrading is not possible, review and restrict network access for applications using this library to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart