npm/ip-address CVE-2026-69198: medium, EPSS 0.48%
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
Action: Upgrade ip-address to 10.2.2 or later.
npm i ip-address@10.2.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.1.1 | 10.2.2 | - |
Fixed versions
| 10.2.2 |
Sources
- osv: GHSA-4xrf-jv44-h6hh
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh
- https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d
- https://github.com/beaugunderson/ip-address
- https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2
CVE-2026-69198 · published · modified · JSON