CVE-2026-69192
1 advisory.
npm/ip-address CVE-2026-69192: high
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
Action: Upgrade ip-address to 10.3.1 or later.
npm i ip-address@10.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.3.1 | - |
Fixed versions
| 10.3.1 |
Sources
- osv: GHSA-mwp4-54f8-5fhr
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr
- https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e
- https://github.com/beaugunderson/ip-address
- https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1
CVE-2026-69192 · published · modified · JSON