Is CVE-2026-101910 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101910 being exploited in the wild.

How severe is CVE-2026-101910?

Medium severity, with a CVSS score of 4, published 28 September 2026.

Which products and versions are affected?

Beaugunderson Ip-Address 10.2.0 to 10.5.0; ip-address (npm) >= 10.2.0, <= 10.5.0, SEMVER:introduced=10.2.0,fixed=10.5.1.

Is there a fix for CVE-2026-101910?

Yes. ip-address (npm): upgrade to 10.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101910 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-101910?

Check whether you run Beaugunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101910: ip-address library Address6 trust boundary bypass via NAT64 range

Q: Is there a fix for CVE-2026-101910?

Yes. ip-address (npm): upgrade to 10.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-101910 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-101910?

Check whether you run Beaugunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101910 · Severity: medium · CVSS 4 · Published 2026-09-28

The ip-address JavaScript library incorrectly classifies NAT64 addresses in the 64:ff9b:1::/48 range as public when they should be treated as private. Applications using this library to make security decisions about whether to trust an IPv6 address may incorrectly allow connections that should be blocked, potentially crossing network security boundaries and exposing internal systems to unauthorized access.

Technologies: Beaugunderson Ip-Address, ip-address (npm). Vendors: Beaugunderson, npm.

Quick answers

Is CVE-2026-101910 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101910 being exploited in the wild.
How severe is CVE-2026-101910?: Medium severity, with a CVSS score of 4, published 28 September 2026.
Which products and versions are affected?: Beaugunderson Ip-Address 10.2.0 to 10.5.0; ip-address (npm) >= 10.2.0, <= 10.5.0, SEMVER:introduced=10.2.0,fixed=10.5.1.
Is there a fix for CVE-2026-101910?: Yes. ip-address (npm): upgrade to 10.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101910 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-101910?: Check whether you run Beaugunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ip-address (npm): upgrade to 10.5.1 or later
```
npm install ip-address@10.5.1
```

Technical details

The Address6.isPrivate() method in src/ipv6.ts fails to recognize the RFC 8215 local-use NAT64 prefix range 64:ff9b:1::/48, causing private IPv4 addresses encoded within that range to be misclassified as public. Applications combining isPrivate(), isLoopback(), and isLinkLocal() for trust decisions can be bypassed. Exploitation requires a network using an operator-selected NAT64 prefix within the local-use range, and the fix is available in version 10.5.1.

Affected products

beaugunderson ip-address 10.2.0 to 10.5.0

Identifiers

CVE-2026-101910
GHSA-2vr4-cq9g-pvrc

Timeline

2026-09-28: disclosed
2026-08-29: patched: Fix released in v10.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.