# CVE-2026-101912: ip-address logic error in subnet containment check

Source: https://junglewise.ai/threats/cve-2026-101912-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101912 · Severity: medium · CVSS 4 · Published 2026-09-28

The ip-address JavaScript library has a logic flaw in its methods that check whether an IP address belongs to a subnet. The vulnerability allows IPv4 and IPv6 addresses to be incorrectly classified as belonging to subnets of the opposite IP version, potentially bypassing address allowlists or denylists that rely on this logic. An attacker could exploit this to make addresses appear to be in restricted ranges when they are not.

Technologies: [ip-address (npm)](https://junglewise.ai/threats/technologies/ip-address). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-101912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101912 being exploited in the wild.

**How severe is CVE-2026-101912?** Medium severity, with a CVSS score of 4, published 28 September 2026.

**Which products and versions are affected?** Beau Gunderson Ip-Address before 10.7.1; ip-address (npm) <= 10.7.0, SEMVER:introduced=0,fixed=10.7.1.

**Is there a fix for CVE-2026-101912?** Yes. ip-address (npm): upgrade to 10.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101912 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-101912?** Check whether you run Beau Gunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ip-address (npm): upgrade to 10.7.1 or later

  ```sh
  npm install ip-address@10.7.1
  ```


## Technical details

The isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands are the same IP family (IPv4 vs IPv6). Since IPv4 addresses are padded to 32 bits and IPv6 to 128 bits, addresses with matching leading bits will incorrectly compare as equal despite the families differing. The fix validates IP family consistency before comparison, ensuring cross-family checks always return false.

## Affected products

- Beau Gunderson ip-address before 10.7.1

## Identifiers

- CVE-2026-101912
- GHSA-j6r3-76f7-8jcv

## Timeline

- 2026-09-28: disclosed
- 2026-09-15: patched: Fix released in version 10.7.1

## References

- [https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28](https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28)
- [https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1](https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1)

## Related threats

- [ip-address Address6 regex denial of service](https://junglewise.ai/threats/duplicate-advisory-ip-address-address6-matches-a-zone-identifier-in-9feed89f)
- [ip-address Address6 quadratic regex denial of service](https://junglewise.ai/threats/cve-2026-111997-ip-address-before-10-7-4-allows-a-denial-of-service-cpu)
- [ip-address Address6 isLinkLocal incomplete subnet check](https://junglewise.ai/threats/cve-2026-101913-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address denial of service in Address6 constructor](https://junglewise.ai/threats/cve-2026-101911-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address library Address6 trust boundary bypass via NAT64 range](https://junglewise.ai/threats/cve-2026-101910-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)