Skip to content
Fencer Vulns
medium 6.9

CVE-2026-54272 json

ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

published 2026-07-27 3 mo ago modified 2026-10-24 16 d ago also EUVD-2026-49375 , GHSA-22jq-vg5j-6vgg

cvss
6.9
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Patch / fix

  • npm ip-address 10.2.1
  • beaugunderson ip-address 10.2.1
  • node-ip-address Debian 14 10.3.1-1

debian advisories DEBIAN-CVE-2026-54272

  • npm RHEL 9 1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee
  • nodejs RHEL 9 1:24.18.0-6.module+el9.8.0+24638+75f46aee
  • nodejs-libs RHEL 9 1:24.18.0-6.module+el9.8.0+24638+75f46aee
  • nodejs-nodemon RHEL 9 3.1.14-3.module+el9.8.0+24638+75f46aee
  • nodejs-full-i18n RHEL 9 1:24.18.0-6.module+el9.8.0+24638+75f46aee
  • nodejs-packaging RHEL 9 2021.06-6.module+el9.8.0+24355+35d95b59
  • nodejs-packaging-bundler RHEL 9 2021.06-6.module+el9.8.0+24355+35d95b59
  • npm RHEL 9 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5

red hat advisories RHSA-2026:62416RHSA-2026:55603RHSA-2026:55601RHSA-2026:54371RHSA-2026:58819

  • nodejs20 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 20.20.2-150500.11.30.1
  • nodejs22 SLE Module for Web and Scripting 15 SP7 22.23.2-150700.3.18.1
  • nodejs24 SLES 16.0, SLES for SAP applications 16.0 24.18.1-160000.1.1
  • nodejs22 SLES 16.0, SLES for SAP applications 16.0 22.23.2-160000.1.1
  • nodejs24 SLE Module for Web and Scripting 15 SP7 24.18.1-150700.15.16.1
  • nodejs20 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 20.20.2-150600.3.21.1
  • nodejs22 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 22.23.2-150600.13.24.1

suse advisories SUSE-SU-2026:3930-1SUSE-SU-2026:3929-1SUSE-SU-2026:3557-1SUSE-SU-2026:23131-1SUSE-SU-2026:23155-1SUSE-SU-2026:23130-1

  • nodejs24 openSUSE Tumbleweed 24.21.0-1.1
  • nodejs26 openSUSE Tumbleweed 26.7.0-1.1
  • nodejs24 openSUSE Leap 16.0 24.18.1-160000.1.1
  • nodejs22 openSUSE Leap 16.0 22.23.2-160000.1.1

opensuse advisories openSUSE-SU-2026:12134-1openSUSE-SU-2026:11611-1openSUSE-SU-2026:21546-1openSUSE-SU-2026:21545-1

  • nodejs24 AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs24-npm AlmaLinux 10 1:11.16.0-1.24.18.0.5.el10_2
  • nodejs24-libs AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs24-full-i18n AlmaLinux 10 1:24.18.0-5.el10_2
  • npm AlmaLinux 9 1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce
  • nodejs AlmaLinux 9 1:22.23.1-3.module_el9.8.0+291+0bb98cce
  • nodejs-libs AlmaLinux 9 1:22.23.1-3.module_el9.8.0+291+0bb98cce
  • nodejs-nodemon AlmaLinux 9 3.1.14-2.module_el9.8.0+291+0bb98cce

almalinux advisories ALSA-2026:58819ALSA-2026:55601ALSA-2026:55603ALSA-2026:54371

  • nodejs Rocky Linux 9 1:24.18.0-6.module+el9.8.0+40281+14cc6568
  • nodejs-nodemon Rocky Linux 9 3.1.14-3.module+el9.8.0+40281+14cc6568
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40165+d075e3f2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.8.0+40164+8921ab53
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40153+4d595597
  • nodejs Rocky Linux 8 1:24.18.0-3.module+el8.10.0+40277+b1b3f89e
  • nodejs-nodemon Rocky Linux 8 3.1.14-2.module+el8.10.0+40277+b1b3f89e

rocky linux advisories RLSA-2026:55603RLSA-2026:54371RLSA-2026:58819

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54272 updated cvss 7.2

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

  • Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8 Red Hat AMQ Broker 7 ip-address 10.1.1 Red Hat Ansible Automation Platform 2 ansible-automation-platform-27/mcp-server-rhel9, ansible-automation-platform-tech-preview/mcp-server-rhel9 Red Hat build of Apache Camel - HawtIO 4 ip-address 10.1.1 Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0
    +6 more products
    Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 rust 1.97.1-1.el10, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-agent-installer-ui-rhel9 Red Hat OpenShift Dev Spaces devspaces/udi-rhel9 Red Hat Satellite 6 satellite/iop-remediations-rhel9
    affected: no fix available
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/console-mce-rhel9 1787264250
    fixed: vendor fix RHSA-2026:59579
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/console-mce-rhel9 1787259048
    fixed: vendor fix RHSA-2026:59558
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/console-mce-rhel9 1787079359
    fixed: vendor fix RHSA-2026:59559
  • Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/console-mce-rhel9 1786668856
    fixed: vendor fix RHSA-2026:59593
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/console-rhel9 1787687062
    fixed: vendor fix RHSA-2026:60387
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/console-rhel9 1787339249
    fixed: vendor fix RHSA-2026:60390
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1787339248
    fixed: vendor fix RHSA-2026:60388
show 21 more
  • Red Hat Advanced Cluster Management for Kubernetes 2.17 rhacm2/console-rhel9 1787335105
    fixed: vendor fix RHSA-2026:60386
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1787047114
    fixed: vendor fix RHSA-2026:56338
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1787047188, ansible-automation-platform/bootc-automation-portal-rhel9 1788943531
    fixed: vendor fix RHSA-2026:56357
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1789554285
    fixed: vendor fix RHSA-2026:69248
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1788286049
    fixed: vendor fix RHSA-2026:62851
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 24.18.0-3.module+el8.10.0+24639+56878497, nodejs-libs 24.18.0-3.module+el8.10.0+24639+56878497, nodejs-nodemon 3.1.14-2.module+el8.10.0+24639+56878497, npm 11.16.0-1.24.18.0.3.module+el8.10.0+24639+56878497, nodejs-full-i18n 24.18.0-3.module+el8.10.0+24639+56878497, nodejs-packaging 2021.06-6.module+el8.10.0+24562+090c6525, +1 more
    fixed: vendor fix RHSA-2026:54371
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 22.23.1-3.module+el9.8.0+24637+e0b636e5, nodejs 24.18.0-6.module+el9.8.0+24638+75f46aee, nodejs-libs 22.23.1-3.module+el9.8.0+24637+e0b636e5, nodejs-libs 24.18.0-6.module+el9.8.0+24638+75f46aee, npm 10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5, nodejs-nodemon 3.1.14-2.module+el9.8.0+24637+e0b636e5, +8 more
    fixed: vendor fix RHSA-2026:55601
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs24 24.18.0-5.el10_2, nodejs24-libs 24.18.0-5.el10_2, nodejs24-full-i18n 24.18.0-5.el10_2, nodejs24-npm 11.16.0-1.24.18.0.5.el10_2
    fixed: vendor fix RHSA-2026:58819
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 22.23.2-1.module+el9.6.0+24769+299a7e3a, nodejs-libs 22.23.2-1.module+el9.6.0+24769+299a7e3a, npm 10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a, nodejs-nodemon 3.1.14-2.module+el9.6.0+24789+4011c12f, nodejs-full-i18n 22.23.2-1.module+el9.6.0+24769+299a7e3a, nodejs-packaging 2021.06-4.module+el9.6.0+23473+45664c2d, +1 more
    fixed: vendor fix RHSA-2026:62416
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-agent-installer-ui-rhel9 1788335236
    fixed: vendor fix RHSA-2026:63103
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-agent-installer-ui-rhel9 1788351578
    fixed: vendor fix RHSA-2026:63046
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-agent-installer-ui-rhel9 1788314963
    fixed: vendor fix RHSA-2026:63096
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/code-rhel9 1789145741, devspaces/openvsx-rhel9 1789144269, devspaces/dashboard-rhel9 1789162884
    fixed: vendor fix RHSA-2026:68754
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1787076495, openshift-service-mesh/kiali-ossmc-rhel9 1787077028
    fixed: vendor fix RHSA-2026:59548
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1787092198, openshift-service-mesh/kiali-ossmc-rhel9 1787075730
    fixed: vendor fix RHSA-2026:59561
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1787092255, openshift-service-mesh/kiali-ossmc-rhel9 1787077188
    fixed: vendor fix RHSA-2026:59554
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1787077108, openshift-service-mesh/kiali-ossmc-rhel9 1787076322
    fixed: vendor fix RHSA-2026:59566
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1787165683, openshift-service-mesh/kiali-ossmc-rhel9 1787166293
    fixed: vendor fix RHSA-2026:59583
  • Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-pccs
    not affected: vulnerable code not present
  • Red Hat Cryostat 4 cryostat/cryostat-openshift-console-plugin-rhel9, grafana-infinity-datasource-npm 3.7.2_redhat_00002-1, cryostat-openshift-console-plugin-npm 4.2.0_redhat_00003-1
    not affected: component not present
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hive-rhel9 1787291123, multicluster-engine/work-rhel9 1787263188, multicluster-engine/discovery-rhel9 1787263531, multicluster-engine/placement-rhel9 1787260699, multicluster-engine/must-gather-rhel9 1787264198, multicluster-engine/registration-rhel9 1787259957, +20 more
    not affected: vulnerable code not present

21 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm ip-address
>=10.1.1, <10.2.1
10.2.1

Affected products

  • beaugunderson ip-address

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.