Executive brief
The ip-address library, used in Node.js applications for IP address validation, has a flaw that causes it to misidentify certain wrapped IPv6 addresses as external when they actually point to internal destinations like loopback interfaces or cloud metadata servers. This allows attackers to bypass network security filters that applications rely on to prevent SSRF attacks—where a web server is coerced into making requests to internal systems that should be inaccessible. An attacker can exploit this by supplying specially crafted IPv6 addresses to bypass such protections.
Technical details
The vulnerability exists in Address6's special-property checks (isLoopback, isLinkLocal, isMulticast, isUnspecified, and the missing isPrivate method). The root cause is twofold: the getType() function's special-use prefix table omitted the ::ffff:0:0/96 IPv4-mapped range, causing all mapped addresses to fall through to "Global unicast" classification; and the classification methods did not normalize embedded IPv4 addresses via the existing isMapped4() and to4() methods before checking their properties. As a result, addresses like ::ffff:127.0.0.1, ::ffff:10.0.0.1, and ::ffff:169.254.169.254 are incorrectly classified as global unicast rather than loopback, private, or link-local. The fix (available in 10.2.1) adds embeddedIPv4() normalization to the classification checks, introduces isPrivate(), isCGNAT(), and isBroadcast() methods to Address6, and updates the TYPES table to recognize IPv4-mapped addresses. Network reachability for IPv4-mapped addresses is available on any dual-stack host; NAT64 requires additional network infrastructure.
Affected products
- npm ip-address 10.1.1 through 10.2.0
Timeline
- 2026-07-25: disclosed: Advisory published on GitHub
- 2026-07-24: patched: Patched version 10.2.1 released
- 2026-08-03: advisory: GHSA-22jq-vg5j-6vgg published on OSV