CVE-2026-54272: beaugunderson ip-address SSRF via address misclassification

CVE-2026-54272 · Severity: medium · CVSS 4 · Published 2026-07-27

The ip-address library, used in Node.js applications for IP address validation, has a flaw that causes it to misidentify certain wrapped IPv6 addresses as external when they actually point to internal destinations like loopback interfaces or cloud metadata servers. This allows attackers to bypass network security filters that applications rely on to prevent SSRF attacks—where a web server is coerced into making requests to internal systems that should be inaccessible. An attacker can exploit this by supplying specially crafted IPv6 addresses to bypass such protections.

Technologies: ip-address (npm). Vendors: npm.

Quick answers

Is CVE-2026-54272 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54272 being exploited in the wild.
How severe is CVE-2026-54272?
Medium severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?
ip-address (npm) >= 10.1.1, <= 10.2.0, 10.1.1 through 10.2.0.
Is there a fix for CVE-2026-54272?
A patch was published on 2026-07-24: Patched version 10.2.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54272 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54272?
Check whether you run ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Address6's special-property checks (isLoopback, isLinkLocal, isMulticast, isUnspecified, and the missing isPrivate method). The root cause is twofold: the getType() function's special-use prefix table omitted the ::ffff:0:0/96 IPv4-mapped range, causing all mapped addresses to fall through to "Global unicast" classification; and the classification methods did not normalize embedded IPv4 addresses via the existing isMapped4() and to4() methods before checking their properties. As a result, addresses like ::ffff:127.0.0.1, ::ffff:10.0.0.1, and ::ffff:169.254.169.254 are incorrectly classified as global unicast rather than loopback, private, or link-local. The fix (available in 10.2.1) adds embeddedIPv4() normalization to the classification checks, introduces isPrivate(), isCGNAT(), and isBroadcast() methods to Address6, and updates the TYPES table to recognize IPv4-mapped addresses. Network reachability for IPv4-mapped addresses is available on any dual-stack host; NAT64 requires additional network infrastructure.

Affected products

  • npm ip-address 10.1.1 through 10.2.0

Identifiers

  • CVE-2026-54272
  • GHSA-22jq-vg5j-6vgg

Timeline

  • 2026-07-25: disclosed: Advisory published on GitHub
  • 2026-07-24: patched: Patched version 10.2.1 released
  • 2026-08-03: advisory: GHSA-22jq-vg5j-6vgg published on OSV

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.