Is CVE-2026-101912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101912 being exploited in the wild.

How severe is CVE-2026-101912?

Medium severity, with a CVSS score of 4, published 28 September 2026.

Which products and versions are affected?

Beau Gunderson Ip-Address before 10.7.1; ip-address (npm) <= 10.7.0, SEMVER:introduced=0,fixed=10.7.1.

Is there a fix for CVE-2026-101912?

Yes. ip-address (npm): upgrade to 10.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101912 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-101912?

Check whether you run Beau Gunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101912: ip-address logic error in subnet containment check

Q: Is there a fix for CVE-2026-101912?

Yes. ip-address (npm): upgrade to 10.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-101912 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-101912?

Check whether you run Beau Gunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101912 · Severity: medium · CVSS 4 · Published 2026-09-28

The ip-address JavaScript library has a logic flaw in its methods that check whether an IP address belongs to a subnet. The vulnerability allows IPv4 and IPv6 addresses to be incorrectly classified as belonging to subnets of the opposite IP version, potentially bypassing address allowlists or denylists that rely on this logic. An attacker could exploit this to make addresses appear to be in restricted ranges when they are not.

Technologies: ip-address (npm). Vendors: npm.

Quick answers

Is CVE-2026-101912 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101912 being exploited in the wild.
How severe is CVE-2026-101912?: Medium severity, with a CVSS score of 4, published 28 September 2026.
Which products and versions are affected?: Beau Gunderson Ip-Address before 10.7.1; ip-address (npm) <= 10.7.0, SEMVER:introduced=0,fixed=10.7.1.
Is there a fix for CVE-2026-101912?: Yes. ip-address (npm): upgrade to 10.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101912 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-101912?: Check whether you run Beau Gunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ip-address (npm): upgrade to 10.7.1 or later
```
npm install ip-address@10.7.1
```

Technical details

The isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands are the same IP family (IPv4 vs IPv6). Since IPv4 addresses are padded to 32 bits and IPv6 to 128 bits, addresses with matching leading bits will incorrectly compare as equal despite the families differing. The fix validates IP family consistency before comparison, ensuring cross-family checks always return false.

Affected products

Beau Gunderson ip-address before 10.7.1

Identifiers

CVE-2026-101912
GHSA-j6r3-76f7-8jcv

Timeline

2026-09-28: disclosed
2026-09-15: patched: Fix released in version 10.7.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.