CVE-2026-42338 json
ip-address: XSS in Address6 HTML-emitting methods
published 2026-05-05 6 mo ago modified 2026-10-26 13 d ago also GHSA-v2v4-37r5-5v8g , EUVD-2026-29785
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
Patch / fix
- npm ip-address 10.1.1
- Red Hat Red Hat Enterprise Linux 10 0:1.1.2-1.el10_2, 1:22.23.1-2.el10_2, 1:24.18.0-1.el10_2
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 1:22.23.1-2.el10_0
- Red Hat Red Hat Enterprise Linux 8 8100020260630152626.6d880403, 8100020260703140402.6d880403
- Red Hat Red Hat Enterprise Linux 9 9080020260626074955.rhel9, 9080020260626075442.rhel9
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260804140259.rhel9
- Red Hat Red Hat Ansible Automation Platform 2.6 1782721130
- Red Hat Red Hat Developer Hub 1.10 1783448184
- Red Hat Red Hat Developer Hub 1.9 1782761244
- Red Hat Red Hat Enterprise Linux AI 3.3 1788260620, 1788260684, 1788273908, 1788273909, 1788273977, 1788290314
- Red Hat Red Hat Migration Toolkit 1.8 1783690532
- Red Hat Red Hat OpenShift AI 2.25 1787801527
- Red Hat Red Hat OpenShift AI 3.4 1787121387
- Red Hat Red Hat OpenShift Container Platform 4.20 1784724699
- Red Hat Red Hat OpenShift Container Platform 4.21 1784713741
- Red Hat Red Hat OpenShift Container Platform 4.22 1784721581
- Red Hat Red Hat Openshift Data Foundation 4.22 1787057250, 1787057603, 1787057849, 1787057964, 1787057989, 1787058278, 1787058403, 1787058450, 1787058588, 1787058658, 1787058706, 1787058807, 1787058970, 1787059072, 1787059085, 1787059538, 1787059616, 1787059853, 1787060257, 1787061098
- Red Hat Red Hat OpenShift Dev Spaces 3.29 1782498475, 1782498792
- Red Hat Red Hat OpenShift Service Mesh 2.6 1781937133, 1782287580
- Red Hat Red Hat OpenShift Service Mesh 3.0 1782201833, 1782201894
- Red Hat Red Hat OpenShift Service Mesh 3.1 1782201537, 1782201696
- Red Hat Red Hat OpenShift Service Mesh 3.2 1782201812, 1782201851
- Red Hat Red Hat OpenShift Service Mesh 3.3 1782201466, 1782231869
- Red Hat Red Hat Satellite 6.19 1786008041
- node-ip-address Debian 14 10.2.0-2
debian advisories DEBIAN-CVE-2026-42338
- rh-podman-desktop RHEL 10.2 1.1.2-1.el10_2
- npm RHEL 8 1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621
- nodejs RHEL 8 1:22.23.1-1.module+el8.10.0+24500+8eb51621
- nodejs-libs RHEL 8 1:22.23.1-1.module+el8.10.0+24500+8eb51621
- nodejs-nodemon RHEL 8 3.0.1-1.module+el8.10.0+24500+8eb51621
- nodejs-full-i18n RHEL 8 1:22.23.1-1.module+el8.10.0+24500+8eb51621
- nodejs-packaging RHEL 8 2021.06-6.module+el8.10.0+24500+8eb51621
- nodejs-packaging-bundler RHEL 8 2021.06-6.module+el8.10.0+24500+8eb51621
red hat advisories RHSA-2026:57590RHSA-2026:52399RHSA-2026:41947RHSA-2026:39868RHSA-2026:39246RHSA-2026:35891
- nodejs20 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 20.20.2-150500.11.30.1
- nodejs24 SLES for SAP applications 16.0, SLES 16.0 24.18.0-160000.1.1
- nodejs22 SLE Module for Web and Scripting 15 SP7 22.23.0-150700.3.12.1
- nodejs24 SLE Module for Web and Scripting 15 SP7 24.17.0-150700.15.11.1
- nodejs22 SLES for SAP applications 16.0, SLES 16.0 22.23.0-160000.1.1
- nodejs20 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 20.20.2-150600.3.21.1
- nodejs22 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 22.23.0-150600.13.18.1
suse advisories SUSE-SU-2026:3930-1SUSE-SU-2026:3929-1SUSE-SU-2026:22565-1SUSE-SU-2026:2695-1SUSE-SU-2026:2647-1SUSE-SU-2026:2633-1
- nodejs24 openSUSE Leap 16.0 24.18.0-160000.1.1
- nodejs22 openSUSE Leap 16.0 22.23.0-160000.1.1
- nodejs24 openSUSE Tumbleweed 24.17.0-1.1
opensuse advisories openSUSE-SU-2026:21236-1openSUSE-SU-2026:21058-1openSUSE-SU-2026:11121-1
- npm AlmaLinux 8 1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855
- nodejs AlmaLinux 8 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
- nodejs-libs AlmaLinux 8 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
- nodejs-nodemon AlmaLinux 8 3.0.1-1.module_el8.10.0+3956+47c9ee9f
- nodejs-full-i18n AlmaLinux 8 1:22.23.1-1.module_el8.10.0+4231+1bf2f855
- nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4158+e796f37f
- nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4158+e796f37f
- npm AlmaLinux 8 1:11.16.0-1.24.18.0.1.module_el8.10.0+4228+2938bc94
almalinux advisories ALSA-2026:41947ALSA-2026:39868ALSA-2026:35841ALSA-2026:35842ALSA-2026:35891ALSA-2026:35892
- nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.9.0+1760+903d54b9
- nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1667+4a788d89
- nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1824+532140ee
- nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1823+b5789597
- nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1924+614dc87f
- nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1666+930e28e8
- nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1988+437f3d23
- nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1989+e60144d9
rocky linux advisories RLSA-2026:41947RLSA-2026:39868RLSA-2026:35841RLSA-2026:35842RLSA-2026:35891RLSA-2026:35892
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-42338 updated cvss 8.1
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
-
Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-pccsaffected: workaround, no fix planned “Will not fix”
-
Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9affected: workaround, no fix available
-
Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9affected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9affected: workaround, no fix available
-
Red Hat build of Apache Camel - HawtIO 4 ip-addressaffected: workaround, no fix planned “Will not fix”
-
Red Hat Build of Podman Desktop rh-podman-desktop.gitaffected: workaround, no fix available
-
Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-sandbox-rhel10affected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux AI (RHEL AI) 3 rust, rhelai3/bootc-gaudi-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
show 31 moreshow fewer
-
Red Hat OpenShift Container Platform 5 openshift4/ose-agent-installer-ui, openshift5/ose-agent-installer-ui-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portalaffected: workaround, no fix available
-
Red Hat AMQ Broker 7.13.6fixed: vendor fix RHSA-2026:66545
-
Red Hat AMQ Broker 7.14.1fixed: vendor fix RHSA-2026:66488
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-tech-preview/mcp-server-rhel9 1782721130fixed: vendor fix RHSA-2026:34374
-
Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1782761244fixed: vendor fix RHSA-2026:33574
-
Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1783448184fixed: vendor fix RHSA-2026:36754
-
Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1788260684, rhelai3/bootc-rocm-rhel9 1788260620, rhelai3/bootc-aws-cuda-rhel9 1788273908, rhelai3/bootc-gcp-cuda-rhel9 1788273977, rhelai3/disk-image-cuda-rhel9 1788290314, rhelai3/bootc-azure-cuda-rhel9 1788273909, +1 morefixed: vendor fix RHSA-2026:62336
-
Red Hat Enterprise Linux AppStream (v. 8) nodejs 22.23.1-1.module+el8.10.0+24500+8eb51621, nodejs 24.18.0-1.module+el8.10.0+24481+7a71fac8, nodejs-libs 22.23.1-1.module+el8.10.0+24500+8eb51621, nodejs-libs 24.18.0-1.module+el8.10.0+24481+7a71fac8, nodejs-nodemon 3.0.1-1.module+el8.10.0+24500+8eb51621, nodejs-nodemon 3.0.3-1.module+el8.10.0+24190+49a46c75, +8 morefixed: vendor fix RHSA-2026:41947
-
Red Hat Enterprise Linux AppStream (v. 9) nodejs 22.23.1-1.module+el9.8.0+24457+996af7aa, nodejs 24.18.0-1.module+el9.8.0+24456+b244c3b4, nodejs-libs 22.23.1-1.module+el9.8.0+24457+996af7aa, nodejs-libs 24.18.0-1.module+el9.8.0+24456+b244c3b4, nodejs-nodemon 3.0.1-1.module+el9.8.0+24156+bb41d456, nodejs-nodemon 3.0.3-3.module+el9.8.0+24355+35d95b59, +8 morefixed: vendor fix RHSA-2026:35892
-
Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.23.1-2.el10_2, nodejs22 22.23.1-2.el10_2, nodejs24 24.18.0-1.el10_2, nodejs-libs 22.23.1-2.el10_2, nodejs24-libs 24.18.0-1.el10_2, nodejs-full-i18n 22.23.1-2.el10_2, +3 morefixed: vendor fix RHSA-2026:35842
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs 22.23.1-2.el10_0, nodejs22 22.23.1-2.el10_0, nodejs-libs 22.23.1-2.el10_0, nodejs-full-i18n 22.23.1-2.el10_0, nodejs-npm 10.9.8-1.22.23.1.2.el10_0fixed: vendor fix RHSA-2026:39246
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 22.23.1-2.module+el9.6.0+24604+449f851b, nodejs-libs 22.23.1-2.module+el9.6.0+24604+449f851b, npm 10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b, nodejs-nodemon 3.1.14-1.module+el9.6.0+24604+449f851b, nodejs-full-i18n 22.23.1-2.module+el9.6.0+24604+449f851b, nodejs-packaging 2021.06-4.module+el9.6.0+23473+45664c2d, +1 morefixed: vendor fix RHSA-2026:52399
-
Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.2-1.el10_2fixed: vendor fix RHSA-2026:57590
-
Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1783690532fixed: vendor fix RHSA-2026:41928
-
Red Hat OpenShift AI 2.25 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1787801527fixed: vendor fix RHSA-2026:65126
-
Red Hat OpenShift AI 3.3 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1790013905fixed: vendor fix RHSA-2026:73987
-
Red Hat OpenShift AI 3.4 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1787121387fixed: vendor fix RHSA-2026:60520
-
Red Hat OpenShift Container Platform 4.20 openshift4/ose-agent-installer-ui-rhel9 1784724699fixed: vendor fix RHSA-2026:44263
-
Red Hat OpenShift Container Platform 4.21 openshift4/ose-agent-installer-ui-rhel9 1784713741fixed: vendor fix RHSA-2026:44267
-
Red Hat OpenShift Container Platform 4.22 openshift4/ose-agent-installer-ui-rhel9 1784721581fixed: vendor fix RHSA-2026:44237
-
Red Hat Openshift Data Foundation 4.22 odf4/cephcsi-rhel9 1787057250, odf4/odf-cli-rhel9 1787058706, odf4/mcg-core-rhel9 1787058450, odf4/odf-drbd-rhel9 1787059538, odf4/odf-console-rhel9 1787059072, odf4/devicefinder-rhel9 1787057603, +22 morefixed: vendor fix RHSA-2026:56928
-
Red Hat OpenShift Dev Spaces 3.29 devspaces/code-rhel9 1782498475, devspaces/dashboard-rhel9 1782498792fixed: vendor fix RHSA-2026:36820
-
Red Hat OpenShift Service Mesh 2.6 openshift-service-mesh/kiali-rhel8 1782287580, openshift-service-mesh/kiali-ossmc-rhel8 1781937133fixed: vendor fix RHSA-2026:33155
-
Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1782201833, openshift-service-mesh/kiali-ossmc-rhel9 1782201894fixed: vendor fix RHSA-2026:33160
-
Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1782201537, openshift-service-mesh/kiali-ossmc-rhel9 1782201696fixed: vendor fix RHSA-2026:33163
-
Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1782201812, openshift-service-mesh/kiali-ossmc-rhel9 1782201851fixed: vendor fix RHSA-2026:33173
-
Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1782201466, openshift-service-mesh/kiali-ossmc-rhel9 1782231869fixed: vendor fix RHSA-2026:33183
-
Red Hat Satellite 6.19 satellite/iop-remediations-rhel9 1786008041fixed: vendor fix RHSA-2026:51200
-
Red Hat Cryostat 4 cryostat-openshift-console-plugin-npm, cryostat/cryostat-openshift-console-plugin-rhel9not affected: component not present
-
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel9not affected: vulnerable code not in execute path
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1782755272, ansible-automation-platform-26/gateway-rhel9 1782761510, ansible-automation-platform-26/hub-web-rhel9 1782759318, ansible-automation-platform-26/receptor-rhel9 1782710613, ansible-automation-platform-26/mcp-tools-rhel9 1782712006, ansible-automation-platform-26/controller-rhel9 1782766803, +24 morenot affected: vulnerable code not present
19 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CISA ADP | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ip-address | <10.1.1 |
10.1.1 |
Affected products
- beaugunderson ip-address
- Red Hat Red Hat AMQ Broker 7.13.6
- Red Hat Red Hat AMQ Broker 7.14.1
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
- Red Hat Red Hat Ansible Automation Platform 2.6
- Red Hat Red Hat Developer Hub 1.10
- Red Hat Red Hat Developer Hub 1.9
- Red Hat Red Hat Enterprise Linux AI 3.3
- Red Hat Red Hat Migration Toolkit 1.8
- Red Hat Red Hat OpenShift AI 2.25
- Red Hat Red Hat OpenShift AI 3.4
- Red Hat Red Hat OpenShift Container Platform 4.20
- Red Hat Red Hat OpenShift Container Platform 4.21
- Red Hat Red Hat OpenShift Container Platform 4.22
- Red Hat Red Hat Openshift Data Foundation 4.22
- Red Hat Red Hat OpenShift Dev Spaces 3.29
- Red Hat Red Hat OpenShift Service Mesh 2.6
- Red Hat Red Hat OpenShift Service Mesh 3.0
- Red Hat Red Hat OpenShift Service Mesh 3.1
- Red Hat Red Hat OpenShift Service Mesh 3.2
- Red Hat Red Hat OpenShift Service Mesh 3.3
- Red Hat Red Hat Satellite 6.19
- Red Hat Confidential Compute Attestation
- Red Hat Cryostat 4
- Red Hat Exploit Intelligence
- Red Hat Multicluster Engine for Kubernetes
- Red Hat OpenShift Pipelines
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Red Hat build of Apache Camel - HawtIO 4
- Red Hat Red Hat Build of Podman Desktop
- Red Hat Red Hat Build of Podman Desktop - Tech Preview
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Red Hat Hardened Images
- Red Hat Red Hat OpenShift Container Platform 4
- Red Hat Red Hat OpenShift Dev Spaces
- Red Hat Self-service automation portal 2
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
References
-
github.com
/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g
exploit, web, mitigation, vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:39246
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:35842
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:35841
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:41947
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:39868
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:52399
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:35892
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:35891
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:57590
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:66545
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:66488
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:34374
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36754
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:33574
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62336
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62335
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:41928
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:65126
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:60520
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:44263
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:44267
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:44237
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36820
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:33155
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:33160
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:33163
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:33173
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:33183
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:56928
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:51200
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2026-42338
vdb-entry
-
bugzilla.redhat.com
/show_bug.cgi?id=2476810
issue-tracking
- security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-42338.json
-
nvd.nist.gov
/vuln/detail/CVE-2026-42338
advisory
-
github.com
/beaugunderson/ip-address
package
Sources
- CVE List CVE-2026-42338
- GitHub Advisory GHSA-v2v4-37r5-5v8g
- NVD CVE-2026-42338
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.