Skip to content
Fencer Vulns
high 7.7

CVE-2026-69192 json

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

published 2026-08-03 3 mo ago modified 2026-10-23 16 d ago also GHSA-mwp4-54f8-5fhr , EUVD-2026-52419

cvss
7.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Patch / fix

  • npm ip-address 10.3.1
  • node-ip-address Debian 14 10.3.1-1

debian advisories DEBIAN-CVE-2026-69192

  • npm RHEL 9 1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee
  • nodejs RHEL 9 1:24.18.0-6.module+el9.8.0+24638+75f46aee
  • nodejs-libs RHEL 9 1:24.18.0-6.module+el9.8.0+24638+75f46aee
  • nodejs-nodemon RHEL 9 3.1.14-3.module+el9.8.0+24638+75f46aee
  • nodejs-full-i18n RHEL 9 1:24.18.0-6.module+el9.8.0+24638+75f46aee
  • nodejs-packaging RHEL 9 2021.06-6.module+el9.8.0+24355+35d95b59
  • nodejs-packaging-bundler RHEL 9 2021.06-6.module+el9.8.0+24355+35d95b59
  • npm RHEL 9 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5

red hat advisories RHSA-2026:64817RHSA-2026:62416RHSA-2026:55603RHSA-2026:55601RHSA-2026:54530RHSA-2026:54371

  • nodejs20 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 20.20.2-150500.11.30.1
  • nodejs20 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 20.20.2-150600.3.21.1

suse advisories SUSE-SU-2026:3930-1SUSE-SU-2026:3929-1

  • nodejs24 AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs24-npm AlmaLinux 10 1:11.16.0-1.24.18.0.5.el10_2
  • nodejs24-libs AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs24-full-i18n AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs AlmaLinux 10 1:22.23.1-6.el10_2
  • nodejs-npm AlmaLinux 10 1:10.9.8-1.22.23.1.6.el10_2
  • nodejs-libs AlmaLinux 10 1:22.23.1-6.el10_2
  • nodejs-full-i18n AlmaLinux 10 1:22.23.1-6.el10_2

almalinux advisories ALSA-2026:58819ALSA-2026:55541ALSA-2026:55601ALSA-2026:55603ALSA-2026:54530ALSA-2026:54371

  • nodejs Rocky Linux 9 1:22.23.1-3.module+el9.8.0+40280+057606e8
  • nodejs-nodemon Rocky Linux 9 3.1.14-2.module+el9.8.0+40264+d9b257bb
  • nodejs-nodemon Rocky Linux 9 3.1.14-2.module+el9.8.0+40280+057606e8
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40165+d075e3f2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.8.0+40164+8921ab53
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40153+4d595597
  • nodejs Rocky Linux 9 1:24.18.0-6.module+el9.8.0+40281+14cc6568

rocky linux advisories RLSA-2026:55601RLSA-2026:55603RLSA-2026:54371RLSA-2026:54530RLSA-2026:58819RLSA-2026:55541

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-69192 updated cvss 8.6

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

  • Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat AMQ Broker 7 ip-address 10.1.1 Red Hat Ansible Automation Platform 2 ansible-automation-platform-27/mcp-server-rhel9, ansible-automation-platform-tech-preview/mcp-server-rhel9 Red Hat build of Apache Camel - HawtIO 4 ip-address 10.1.1 Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rust 1.97.1-1.el10, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-openshift-console-plugin-rhel9 4.2.0-14
    fixed: vendor fix RHSA-2026:68333
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/console-mce-rhel9 1787264250
    fixed: vendor fix RHSA-2026:59579
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/console-mce-rhel9 1787259048
    fixed: vendor fix RHSA-2026:59558
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/console-mce-rhel9 1787079359
    fixed: vendor fix RHSA-2026:59559
  • Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/console-mce-rhel9 1786668856
    fixed: vendor fix RHSA-2026:59593
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/console-rhel9 1787687062
    fixed: vendor fix RHSA-2026:60387
show 27 more
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/console-rhel9 1787339249
    fixed: vendor fix RHSA-2026:60390
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1787339248
    fixed: vendor fix RHSA-2026:60388
  • Red Hat Advanced Cluster Management for Kubernetes 2.17 rhacm2/console-rhel9 1787335105
    fixed: vendor fix RHSA-2026:60386
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1787047114
    fixed: vendor fix RHSA-2026:56338
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1787047188, ansible-automation-platform/bootc-automation-portal-rhel9 1788943531
    fixed: vendor fix RHSA-2026:56357
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1789554285
    fixed: vendor fix RHSA-2026:69248
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1788286049, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed 1788187400, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator 1788186989, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend 1788186854, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend 1788187326, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets 1788186625, +2 more
    fixed: vendor fix RHSA-2026:61721
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 22.23.1-3.module+el8.10.0+24640+6eba5e6e, nodejs 24.18.0-3.module+el8.10.0+24639+56878497, nodejs-libs 22.23.1-3.module+el8.10.0+24640+6eba5e6e, nodejs-libs 24.18.0-3.module+el8.10.0+24639+56878497, npm 10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e, nodejs-nodemon 3.1.14-2.module+el8.10.0+24639+56878497, +8 more
    fixed: vendor fix RHSA-2026:54530
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 22.23.1-3.module+el9.8.0+24637+e0b636e5, nodejs 24.18.0-6.module+el9.8.0+24638+75f46aee, nodejs-libs 22.23.1-3.module+el9.8.0+24637+e0b636e5, nodejs-libs 24.18.0-6.module+el9.8.0+24638+75f46aee, npm 10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5, nodejs-nodemon 3.1.14-2.module+el9.8.0+24637+e0b636e5, +8 more
    fixed: vendor fix RHSA-2026:55601
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.23.1-6.el10_2, nodejs22 22.23.1-6.el10_2, nodejs24 24.18.0-5.el10_2, nodejs-libs 22.23.1-6.el10_2, nodejs24-libs 24.18.0-5.el10_2, nodejs-full-i18n 22.23.1-6.el10_2, +3 more
    fixed: vendor fix RHSA-2026:55541
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs 22.23.2-1.el10_0, nodejs22 22.23.2-1.el10_0, nodejs-libs 22.23.2-1.el10_0, nodejs-full-i18n 22.23.2-1.el10_0, nodejs-npm 10.9.8-1.22.23.2.1.el10_0
    fixed: vendor fix RHSA-2026:64817
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 22.23.2-1.module+el9.6.0+24769+299a7e3a, nodejs-libs 22.23.2-1.module+el9.6.0+24769+299a7e3a, npm 10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a, nodejs-nodemon 3.1.14-2.module+el9.6.0+24789+4011c12f, nodejs-full-i18n 22.23.2-1.module+el9.6.0+24769+299a7e3a, nodejs-packaging 2021.06-4.module+el9.6.0+23473+45664c2d, +1 more
    fixed: vendor fix RHSA-2026:62416
  • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.2-1.el10_2
    fixed: vendor fix RHSA-2026:57590
  • Red Hat Hardened Images grafana12.4 12.4.7-0.1.hum1, grafana13.1 13.1.2-0.1.hum1, grafana12.4 12.4.6-0.4.1.hum1, grafana13.1 13.1.1-0.5.2.hum1
    fixed: vendor fix RHSA-2026:50854
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1789546373
    fixed: vendor fix RHSA-2026:68681
  • Red Hat OpenShift AI 2.25 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1787801527
    fixed: vendor fix RHSA-2026:65126
  • Red Hat OpenShift AI 3.3 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1790013905
    fixed: vendor fix RHSA-2026:73987
  • Red Hat OpenShift AI 3.4 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1787121387
    fixed: vendor fix RHSA-2026:60520
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-agent-installer-ui-rhel9 1788335236
    fixed: vendor fix RHSA-2026:63103
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-agent-installer-ui-rhel9 1788314963
    fixed: vendor fix RHSA-2026:63096
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/code-rhel9 1789145741, devspaces/openvsx-rhel9 1789144269, devspaces/dashboard-rhel9 1789162884
    fixed: vendor fix RHSA-2026:68754
  • Red Hat OpenShift Dev Spaces 3.31 devspaces/udi-rhel9 1792708612
    fixed: vendor fix RHSA-2026:90321
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1787076495, openshift-service-mesh/kiali-ossmc-rhel9 1787077028
    fixed: vendor fix RHSA-2026:59548
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1787092198, openshift-service-mesh/kiali-ossmc-rhel9 1787075730
    fixed: vendor fix RHSA-2026:59561
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1787092255, openshift-service-mesh/kiali-ossmc-rhel9 1787077188
    fixed: vendor fix RHSA-2026:59554
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1787077108, openshift-service-mesh/kiali-ossmc-rhel9 1787076322
    fixed: vendor fix RHSA-2026:59566
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1787165683, openshift-service-mesh/kiali-ossmc-rhel9 1787166293
    fixed: vendor fix RHSA-2026:59583

2 more fixed, 32 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm ip-address
<10.3.1
10.3.1

Affected products

  • beaugunderson ip-address

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.