# ip-address (npm) vulnerabilities 9 known vulnerabilities (1 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 10.7.6 (Nov 3, 2026): no advisory affects it - Newest unaffected release: 10.7.6 (Nov 3, 2026), the latest release - Weekly downloads: 132.9M - Dependents: 189K - Releases: 69 since 3.2.0 (May 5, 2015) - Registry: https://www.npmjs.com/package/ip-address - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-111997: 3.2.0 to 10.7.3 (10.7.4 is outside it) - CVE-2026-101913: 3.2.0 to 10.5.0 (10.5.1 is outside it) - CVE-2026-101912: 3.2.0 to 10.7.0 (10.7.1 is outside it) - CVE-2026-101911: 3.2.0 to 10.7.0 (10.7.1 is outside it) - CVE-2026-101910: 10.2.0 to 10.5.0 (10.5.1 is outside it) - CVE-2026-69198: 10.1.1 to 10.2.1 (10.2.2 is outside it) - CVE-2026-69192: 3.2.0 to 10.3.0 (10.3.1 is outside it) - CVE-2026-54272: 10.1.1 to 10.2.0 (10.2.1 is outside it) - CVE-2026-42338: 3.2.0 to 10.1.0 (10.1.1 is outside it) ## Advisories (9) ### [CVE-2026-111997](https://cve.now/CVE-2026-111997): ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters - Severity: Medium 6.3 - Published: Oct 18, 2026 - Affected: fixed in 10.7.4. - Fixed in 10.7.4 (released Oct 11, 2026, 7 days before disclosure). - The latest release, 10.7.6, is not affected. - 59% of ip-address downloads last week were affected versions (85M). ### [CVE-2026-101913](https://cve.now/CVE-2026-101913): ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts - Severity: Medium 6.3 - Published: Sep 28, 2026 - Affected: fixed in 10.5.1. - Fixed in 10.5.1 (released Aug 29, 2026, 30 days before disclosure). - The latest release, 10.7.6, is not affected. - 45% of ip-address downloads last week were affected versions (64.7M). ### [CVE-2026-101912](https://cve.now/CVE-2026-101912): ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range - Severity: Medium 6.3 - Published: Sep 28, 2026 - Affected: fixed in 10.7.1. - Fixed in 10.7.1 (released Sep 15, 2026, 13 days before disclosure). - The latest release, 10.7.6, is not affected. - 48% of ip-address downloads last week were affected versions (69.4M). ### [CVE-2026-101911](https://cve.now/CVE-2026-101911): ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process - Severity: Medium 6.3 - Published: Sep 28, 2026 - Affected: fixed in 10.7.1. - Fixed in 10.7.1 (released Sep 15, 2026, 13 days before disclosure). - The latest release, 10.7.6, is not affected. - 48% of ip-address downloads last week were affected versions (69.4M). ### [CVE-2026-101910](https://cve.now/CVE-2026-101910): ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass - Severity: Medium 6.9 - Published: Sep 28, 2026 - Affected: from 10.2.0, fixed in 10.5.1. - Fixed in 10.5.1 (released Aug 29, 2026, 30 days before disclosure). - The latest release, 10.7.6, is not affected. - 21% of ip-address downloads last week were affected versions (30.4M). ### [CVE-2026-69198](https://cve.now/CVE-2026-69198): ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks - Severity: Medium 6.9 - Published: Aug 3, 2026 - Affected: from 10.1.1, fixed in 10.2.2. - Fixed in 10.2.2 (released Jul 25, 2026, 9 days before disclosure). - The latest release, 10.7.6, is not affected. - 12% of ip-address downloads last week were affected versions (17.9M). ### [CVE-2026-69192](https://cve.now/CVE-2026-69192): ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass - Severity: High 7.7 - Published: Aug 3, 2026 - Affected: fixed in 10.3.1. - Fixed in 10.3.1 (released Jul 25, 2026, 9 days before disclosure). - The latest release, 10.7.6, is not affected. - 36% of ip-address downloads last week were affected versions (51.6M). ### [CVE-2026-54272](https://cve.now/CVE-2026-54272): ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks - Severity: Medium 6.9 - Published: Jul 27, 2026 - Affected: from 10.1.1, fixed in 10.2.1. - Fixed in 10.2.1 (released Jul 25, 2026, 2 days before disclosure). - The latest release, 10.7.6, is not affected. - 12% of ip-address downloads last week were affected versions (17.8M). ### [CVE-2026-42338](https://cve.now/CVE-2026-42338): ip-address: XSS in Address6 HTML-emitting methods - Severity: Medium 5.3 - Published: May 12, 2026 - Affected: fixed in 10.1.1. - Fixed in 10.1.1 (released Apr 27, 2026, 15 days before disclosure). - The latest release, 10.7.6, is not affected. - 23% of ip-address downloads last week were affected versions (33.7M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/ip-address Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.