CVE-2026-101913
Received Received - Intake

IPv6 Link-Local Bypass in ip-address Library

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101913
EUVD
EUVD-2026-88399

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
beaugunderson ip-address to 10.5.1 (exc)
beaugunderson ip-address 10.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the ip-address library (versions <= 10.5.0) involves a flawed IPv6 link-local address check. The isLinkLocal method incorrectly validates only fe80::/64 instead of the full fe80::/10 range per RFC 4291. This causes inconsistent classification where some link-local addresses (e.g., fe81::1) are missed by isLinkLocal but correctly identified by other methods like getType and getScope.

Detection Guidance

Check if your system uses the vulnerable ip-address library version (<=10.5.0). Run: npm list ip-address. If installed, verify if your application uses Address6.isLinkLocal() for trust-boundary checks.

Impact Analysis

This flaw enables Server-Side Request Forgery (SSRF) attacks. Applications using isLinkLocal to block internal requests may incorrectly permit access to on-link hosts outside the intended trust boundary. Attackers can bypass security filters and reach internal network segments by exploiting this misclassification.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized network access. If applications rely on the flawed isLinkLocal method to enforce network segmentation or restrict access to internal resources, attackers could bypass these controls and reach internal hosts. This may violate requirements for network security controls, data protection, and access management in these regulations.

Mitigation Strategies

Upgrade the ip-address library to version 10.5.1 or later. If immediate upgrade is not possible, implement a temporary workaround by directly testing IPv6 addresses against the fe80::/10 range.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101913. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart