JavaScript Library Vulnerability in ip-address Affecting Multiple Versions
CVE-2026-69198

6.9MEDIUM

Key Information:

Vendor

Beaugunderson

Status
Ip-address
Vendor
CVE Published:
3 August 2026

What is CVE-2026-69198?

The ip-address library, a tool used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, has a vulnerability that affects classification methods between versions 10.1.1 and 10.2.2. The method isInSubnet fails to classify certain internal addresses correctly due to an issue with subnet mask comparison. This can lead to incorrect network trust-boundary decisions, potentially allowing Server-Side Request Forgery (SSRF) attacks by misclassifying internal addresses as external. The vulnerability has been addressed in version 10.2.2.

Affected Version(s)

ip-address >= 10.1.1, < 10.2.2

References

https://github.com/beaugunderson/ip-address/security/advi...
x_refsource_CONFIRM
https://github.com/beaugunderson/ip-address/commit/488fe9...
x_refsource_MISC
https://github.com/beaugunderson/ip-address/releases/tag/...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.