CVE-2026-69192
Received Received - Intake

Octal Parsing Misinterpretation in ip-address Library

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69192
EUVD
EUVD-2026-52419

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ip_address ip_address to 10.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the ip-address JavaScript library prior to version 10.3.1. When parsing IPv4 addresses with leading zeros, the library incorrectly interprets them as decimal numbers while other systems like WHATWG URL parser treat them as octal. This causes a mismatch between the library's interpretation and the actual network stack behavior.

Detection Guidance

This vulnerability can be detected by checking if your system uses the vulnerable version of the ip-address library (prior to 10.3.1). Inspect package.json or dependency files for the library version. Test with inputs like '012.0.0.1' to see if Address4 and network stack disagree on the parsed IP address.

Impact Analysis

This vulnerability can lead to security bypasses. For example, an application using this library to block internal IP addresses might incorrectly allow access to internal resources if the IP is written with leading zeros. This could enable Server-Side Request Forgery (SSRF) attacks where an attacker tricks the application into connecting to unintended internal systems.

Compliance Impact

This vulnerability could lead to unauthorized network access by misclassifying internal addresses as external, potentially violating data protection requirements under GDPR or HIPAA that mandate strict access controls and network segmentation.

Mitigation Strategies

Upgrade the ip-address library to version 10.3.1 or later. Review applications using Address4 for trust-boundary decisions, such as SSRF filters, to ensure they account for potential IP parsing discrepancies. Monitor network requests for unexpected connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart