SSRF Vulnerability in ip-address Library by Beau Gunderson
CVE-2026-54272

6.9MEDIUM

Key Information:

Vendor

Beaugunderson

Status
Ip-address
Vendor
CVE Published:
27 July 2026

What is CVE-2026-54272?

The ip-address library versions 10.1.1 through 10.2.0 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This issue arises from improper classification of IPv4-mapped and NAT64 IPv6 addresses, leading to potential exploitation on dual-stack hosts. The function Address6.getType() misclassifies these addresses, resulting in unintended access paths for malicious requests. This flaw allows attackers to manipulate address classification, potentially bypassing network defenses. The vulnerability has been resolved in version 10.2.1.

Affected Version(s)

ip-address >= 10.1.1, < 10.2.1

References

https://github.com/beaugunderson/ip-address/security/advi...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.