CVE-2026-42338: beaugunderson ip-address XSS in Address6 HTML-emitting methods

CVE-2026-42338 · Severity: medium · CVSS 6.1 · Published 2026-05-12

The ip-address library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, contains a vulnerability that could allow for cross-site scripting (XSS). If an application processes untrusted input using certain library methods and then displays the results as HTML, an attacker could execute malicious scripts in a user's browser. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technologies: ip-address (npm). Vendors: npm.

Quick answers

Is CVE-2026-42338 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42338 being exploited in the wild.
How severe is CVE-2026-42338?
Medium severity, with a CVSS score of 6.1, published 12 May 2026.
Which products and versions are affected?
ip-address (npm) <= 10.1.0, SEMVER:introduced=0,fixed=10.1.1.
Is there a fix for CVE-2026-42338?
Yes. ip-address (npm): upgrade to 10.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42338 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42338?
Check whether you run ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ip-address (npm): upgrade to 10.1.1 or later
    npm install ip-address@10.1.1

Technical details

A cross-site scripting (XSS) vulnerability exists in the ip-address library due to a failure to properly HTML-escape attacker-controlled content in several methods, including Address6.group(), Address6.link(), and AddressError.parseMessage. Specifically, the Address6.group() method fails to escape IPv6 zone identifiers, and Address6.link() allows for attribute-value injection via user-supplied prefix and className options. Additionally, the Address6 constructor can leak unescaped content into error messages during certain IPv4-in-IPv6 parsing failures. An attacker can exploit this by providing a crafted IP address string containing HTML or JavaScript. If the application subsequently renders the library's output using methods like innerHTML, the script will execute in the victim's browser context. The issue is fixed in version 10.1.1.

Affected products

  • beaugunderson ip-address < 10.1.1

Identifiers

  • CVE-2026-42338
  • GHSA-v2v4-37r5-5v8g

Timeline

  • 2026-04-27: advisory: GitHub security advisory published by maintainer
  • 2026-05-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.