# CVE-2026-101910: ip-address library Address6 trust boundary bypass via NAT64 range

Source: https://junglewise.ai/threats/cve-2026-101910-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101910 · Severity: medium · CVSS 4 · Published 2026-09-28

The ip-address JavaScript library incorrectly classifies NAT64 addresses in the 64:ff9b:1::/48 range as public when they should be treated as private. Applications using this library to make security decisions about whether to trust an IPv6 address may incorrectly allow connections that should be blocked, potentially crossing network security boundaries and exposing internal systems to unauthorized access.

Technologies: [Beaugunderson Ip-Address](https://junglewise.ai/threats/technologies/beaugunderson-ip-address), [ip-address (npm)](https://junglewise.ai/threats/technologies/ip-address). Vendors: [Beaugunderson](https://junglewise.ai/threats/vendors/beaugunderson), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-101910 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101910 being exploited in the wild.

**How severe is CVE-2026-101910?** Medium severity, with a CVSS score of 4, published 28 September 2026.

**Which products and versions are affected?** Beaugunderson Ip-Address 10.2.0 to 10.5.0; ip-address (npm) >= 10.2.0, <= 10.5.0, SEMVER:introduced=10.2.0,fixed=10.5.1.

**Is there a fix for CVE-2026-101910?** Yes. ip-address (npm): upgrade to 10.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101910 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-101910?** Check whether you run Beaugunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ip-address (npm): upgrade to 10.5.1 or later

  ```sh
  npm install ip-address@10.5.1
  ```


## Technical details

The Address6.isPrivate() method in src/ipv6.ts fails to recognize the RFC 8215 local-use NAT64 prefix range 64:ff9b:1::/48, causing private IPv4 addresses encoded within that range to be misclassified as public. Applications combining isPrivate(), isLoopback(), and isLinkLocal() for trust decisions can be bypassed. Exploitation requires a network using an operator-selected NAT64 prefix within the local-use range, and the fix is available in version 10.5.1.

## Affected products

- beaugunderson ip-address 10.2.0 to 10.5.0

## Identifiers

- CVE-2026-101910
- GHSA-2vr4-cq9g-pvrc

## Timeline

- 2026-09-28: disclosed
- 2026-08-29: patched: Fix released in v10.5.1

## References

- [https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8](https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8)
- [https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1](https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1)

## Related threats

- [ip-address Address6 regex denial of service](https://junglewise.ai/threats/duplicate-advisory-ip-address-address6-matches-a-zone-identifier-in-9feed89f)
- [ip-address Address6 quadratic regex denial of service](https://junglewise.ai/threats/cve-2026-111997-ip-address-before-10-7-4-allows-a-denial-of-service-cpu)
- [ip-address Address6 isLinkLocal incomplete subnet check](https://junglewise.ai/threats/cve-2026-101913-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address logic error in subnet containment check](https://junglewise.ai/threats/cve-2026-101912-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address denial of service in Address6 constructor](https://junglewise.ai/threats/cve-2026-101911-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)