CVE-2026-69198
Received Received - Intake

ip-address JavaScript Library Subnet Mask Bypass

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69198
EUVD
EUVD-2026-52422

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the ip-address library (versions 10.1.1 to 10.2.1) causes incorrect classification of IP addresses. When an address has a CIDR suffix like /0, methods like isLoopback() or isPrivate() return false even for internal addresses, making them appear unremarkable. This happens because the classification methods rely on isInSubnet, which short-circuits incorrectly when the address mask is shorter than the reference range.

Detection Guidance

Detection requires checking if your application uses the ip-address library versions between 10.1.1 and 10.2.1. Inspect package.json or dependency files for the library version. No specific commands are provided as detection depends on the application context.

Impact Analysis

Applications using this library for network trust-boundary decisions, such as SSRF filters, may incorrectly allow requests to internal targets by treating them as external. This could lead to unauthorized access to internal systems or data leaks if the application relies on these checks to block malicious requests.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling unauthorized network access. If an application relies on incorrect IP classification (e.g., treating internal addresses as external), it may fail to enforce proper access controls, potentially violating data protection requirements.

Mitigation Strategies

Upgrade the ip-address library to version 10.2.2 or later to fix the issue. If immediate upgrade is not possible, review applications using the library for trust-boundary decisions and add additional validation for internal address checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart