{"action":"Upgrade ip-address to 10.7.1 or later.","affected":[{"fixed":"10.7.1","introduced":"0"}],"component":"ip-address","cve_ids":["CVE-2026-101912"],"ecosystem":"npm","epss":0.0037,"exploited":false,"fixed_versions":["10.7.1"],"ghsa_id":"GHSA-j6r3-76f7-8jcv","id":"tcs_01M5KFX6VB8E5WYF0K9CDASN2F","modified_at":"2026-09-30T00:00:03.843448355Z","published_at":"2026-09-29T23:46:52Z","references":["https://osv.dev/vulnerability/GHSA-j6r3-76f7-8jcv","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-j6r3-76f7-8jcv","url":"https://osv.dev/vulnerability/GHSA-j6r3-76f7-8jcv"}],"summary":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range"}