npm/ip-address CVE-2026-54272: medium, EPSS 0.40%
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
Action: Upgrade ip-address to 10.2.1 or later.
npm i ip-address@10.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.1.1 | 10.2.1 | - |
Fixed versions
| 10.2.1 |
Sources
- osv: GHSA-22jq-vg5j-6vgg
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg
- https://nvd.nist.gov/vuln/detail/CVE-2026-54272
- https://github.com/beaugunderson/ip-address/commit/4a1f613f4c1bec915677dea923c10aaa09361ef9
- https://github.com/beaugunderson/ip-address
- https://github.com/beaugunderson/ip-address/releases/tag/v10.2.1
CVE-2026-54272 · published · modified · JSON