Executive brief
The ip-address library, used for parsing and validating network addresses, incorrectly handles IPv4 addresses that contain leading zeros. While the library interprets these as standard decimal numbers, most web browsers and operating systems interpret them as octal (base-8) numbers. This discrepancy allows an attacker to bypass security filters, potentially leading to Server-Side Request Forgery (SSRF) where the attacker can access internal company data or services that should be restricted.
Technical details
The vulnerability exists in the Address4.parse component due to an overly permissive regular expression (RE_ADDRESS) and the use of parseInt(part, 10) for decoding octets. While the library treats a leading zero (e.g., '012') as decimal 12, standard resolvers (inet_aton, getaddrinfo) and the WHATWG URL host parser treat it as octal, resolving to 10. This inconsistency allows attackers to craft ambiguous IP strings that bypass isPrivate() or isInSubnet() checks in SSRF filters. The issue affects all versions up to 10.3.0 and is resolved in version 10.3.1 by rejecting octets with leading zeros.
Affected products
- beaugunderson ip-address <= 10.3.0
Timeline
- 2026-07-25: disclosed
- 2026-07-25: patched: Version 10.3.1 released
- 2026-08-03: advisory
References
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr
- https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e
- https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1
- https://api.github.com/repos/beaugunderson/ip-address/security-advisories/GHSA-mwp4-54f8-5fhr