# CVE-2026-54272: beaugunderson ip-address SSRF via address misclassification

Source: https://junglewise.ai/threats/cve-2026-54272-beaugunderson-ip-address-ssrf-via-address-misclassification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-54272 · Severity: medium · CVSS 4 · Published 2026-07-27

The ip-address library, used in Node.js applications for IP address validation, has a flaw that causes it to misidentify certain wrapped IPv6 addresses as external when they actually point to internal destinations like loopback interfaces or cloud metadata servers. This allows attackers to bypass network security filters that applications rely on to prevent SSRF attacks—where a web server is coerced into making requests to internal systems that should be inaccessible. An attacker can exploit this by supplying specially crafted IPv6 addresses to bypass such protections.

Technologies: [ip-address (npm)](https://junglewise.ai/threats/technologies/ip-address). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54272 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54272 being exploited in the wild.

**How severe is CVE-2026-54272?** Medium severity, with a CVSS score of 4, published 27 July 2026.

**Which products and versions are affected?** ip-address (npm) >= 10.1.1, <= 10.2.0, 10.1.1 through 10.2.0.

**Is there a fix for CVE-2026-54272?** A patch was published on 2026-07-24: Patched version 10.2.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54272 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54272?** Check whether you run ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Address6's special-property checks (isLoopback, isLinkLocal, isMulticast, isUnspecified, and the missing isPrivate method). The root cause is twofold: the getType() function's special-use prefix table omitted the ::ffff:0:0/96 IPv4-mapped range, causing all mapped addresses to fall through to "Global unicast" classification; and the classification methods did not normalize embedded IPv4 addresses via the existing isMapped4() and to4() methods before checking their properties. As a result, addresses like ::ffff:127.0.0.1, ::ffff:10.0.0.1, and ::ffff:169.254.169.254 are incorrectly classified as global unicast rather than loopback, private, or link-local. The fix (available in 10.2.1) adds embeddedIPv4() normalization to the classification checks, introduces isPrivate(), isCGNAT(), and isBroadcast() methods to Address6, and updates the TYPES table to recognize IPv4-mapped addresses. Network reachability for IPv4-mapped addresses is available on any dual-stack host; NAT64 requires additional network infrastructure.

## Affected products

- npm ip-address 10.1.1 through 10.2.0

## Identifiers

- CVE-2026-54272
- GHSA-22jq-vg5j-6vgg

## Timeline

- 2026-07-25: disclosed: Advisory published on GitHub
- 2026-07-24: patched: Patched version 10.2.1 released
- 2026-08-03: advisory: GHSA-22jq-vg5j-6vgg published on OSV

## References

- [https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg)
- [https://github.com/beaugunderson/ip-address/commit/4a1f613f4c1bec915677dea923c10aaa09361ef9](https://github.com/beaugunderson/ip-address/commit/4a1f613f4c1bec915677dea923c10aaa09361ef9)
- [https://github.com/beaugunderson/ip-address](https://github.com/beaugunderson/ip-address)
- [https://github.com/beaugunderson/ip-address/releases/tag/v10.2.1](https://github.com/beaugunderson/ip-address/releases/tag/v10.2.1)

## Related threats

- [ip-address Address6 regex denial of service](https://junglewise.ai/threats/duplicate-advisory-ip-address-address6-matches-a-zone-identifier-in-9feed89f)
- [ip-address Address6 quadratic regex denial of service](https://junglewise.ai/threats/cve-2026-111997-ip-address-before-10-7-4-allows-a-denial-of-service-cpu)
- [ip-address Address6 isLinkLocal incomplete subnet check](https://junglewise.ai/threats/cve-2026-101913-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address logic error in subnet containment check](https://junglewise.ai/threats/cve-2026-101912-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address denial of service in Address6 constructor](https://junglewise.ai/threats/cve-2026-101911-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)