Skip to main content
cve.nowby Sazabi
← npm
npmPackage

ip-address

9 known vulnerabilities (1 high, 8 medium), with the versions each affects and the releases that fix them.

Latest release
10.7.6 (Nov 3, 2026): no advisory affects it
Newest unaffected release
10.7.6 (Nov 3, 2026), the latest release
Advisories
9 · 1 high, 8 medium
Weekly downloads
132.9M
Dependents
189K
Releases
69 since 3.2.0 (May 5, 2015)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

  • CVE-2026-111997Medium 6.3

    ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters

    Affected: fixed in 10.7.4.

    Fixed in 10.7.4 (released Oct 11, 2026, 7 days before disclosure).

    The latest release, 10.7.6, is not affected.

    59% of ip-address downloads last week were affected versions (85M).

  • CVE-2026-101913Medium 6.3

    ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

    Affected: fixed in 10.5.1.

    Fixed in 10.5.1 (released Aug 29, 2026, 30 days before disclosure).

    The latest release, 10.7.6, is not affected.

    45% of ip-address downloads last week were affected versions (64.7M).

  • CVE-2026-101912Medium 6.3

    ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

    Affected: fixed in 10.7.1.

    Fixed in 10.7.1 (released Sep 15, 2026, 13 days before disclosure).

    The latest release, 10.7.6, is not affected.

    48% of ip-address downloads last week were affected versions (69.4M).

  • CVE-2026-101911Medium 6.3

    ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

    Affected: fixed in 10.7.1.

    Fixed in 10.7.1 (released Sep 15, 2026, 13 days before disclosure).

    The latest release, 10.7.6, is not affected.

    48% of ip-address downloads last week were affected versions (69.4M).

  • CVE-2026-101910Medium 6.9

    ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

    Affected: from 10.2.0, fixed in 10.5.1.

    Fixed in 10.5.1 (released Aug 29, 2026, 30 days before disclosure).

    The latest release, 10.7.6, is not affected.

    21% of ip-address downloads last week were affected versions (30.4M).

  • CVE-2026-69198Medium 6.9

    ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

    Affected: from 10.1.1, fixed in 10.2.2.

    Fixed in 10.2.2 (released Jul 25, 2026, 9 days before disclosure).

    The latest release, 10.7.6, is not affected.

    12% of ip-address downloads last week were affected versions (17.9M).

  • ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

    Affected: fixed in 10.3.1.

    Fixed in 10.3.1 (released Jul 25, 2026, 9 days before disclosure).

    The latest release, 10.7.6, is not affected.

    36% of ip-address downloads last week were affected versions (51.6M).

  • CVE-2026-54272Medium 6.9

    ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

    Affected: from 10.1.1, fixed in 10.2.1.

    Fixed in 10.2.1 (released Jul 25, 2026, 2 days before disclosure).

    The latest release, 10.7.6, is not affected.

    12% of ip-address downloads last week were affected versions (17.8M).

  • CVE-2026-42338Medium 5.3

    ip-address: XSS in Address6 HTML-emitting methods

    Affected: fixed in 10.1.1.

    Fixed in 10.1.1 (released Apr 27, 2026, 15 days before disclosure).

    The latest release, 10.7.6, is not affected.

    23% of ip-address downloads last week were affected versions (33.7M).