# CVE-2026-69192: beaugunderson ip-address SSRF via improper leading-zero octal decoding

Source: https://junglewise.ai/threats/cve-2026-69192-beaugunderson-ip-address-ssrf-via-improper-leading-zero-octal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-69192 · Severity: high · CVSS 7.7 · Published 2026-08-03

The ip-address library, used for parsing and validating network addresses, incorrectly handles IPv4 addresses that contain leading zeros. While the library interprets these as standard decimal numbers, most web browsers and operating systems interpret them as octal (base-8) numbers. This discrepancy allows an attacker to bypass security filters, potentially leading to Server-Side Request Forgery (SSRF) where the attacker can access internal company data or services that should be restricted.

Technologies: [ip-address (npm)](https://junglewise.ai/threats/technologies/ip-address). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-69192 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69192 being exploited in the wild.

**How severe is CVE-2026-69192?** High severity, with a CVSS score of 7.7, published 3 August 2026.

**Which products and versions are affected?** ip-address (npm) <= 10.3.0.

**Is there a fix for CVE-2026-69192?** A patch was published on 2026-07-25: Version 10.3.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69192 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69192?** Check whether you run ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Address4.parse component due to an overly permissive regular expression (RE_ADDRESS) and the use of parseInt(part, 10) for decoding octets. While the library treats a leading zero (e.g., '012') as decimal 12, standard resolvers (inet_aton, getaddrinfo) and the WHATWG URL host parser treat it as octal, resolving to 10. This inconsistency allows attackers to craft ambiguous IP strings that bypass isPrivate() or isInSubnet() checks in SSRF filters. The issue affects all versions up to 10.3.0 and is resolved in version 10.3.1 by rejecting octets with leading zeros.

## Affected products

- beaugunderson ip-address <= 10.3.0

## Identifiers

- CVE-2026-69192
- GHSA-mwp4-54f8-5fhr

## Timeline

- 2026-07-25: disclosed
- 2026-07-25: patched: Version 10.3.1 released
- 2026-08-03: advisory

## References

- [https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr)
- [https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e](https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e)
- [https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1](https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1)
- [https://api.github.com/repos/beaugunderson/ip-address/security-advisories/GHSA-mwp4-54f8-5fhr](https://api.github.com/repos/beaugunderson/ip-address/security-advisories/GHSA-mwp4-54f8-5fhr)

## Related threats

- [ip-address Address6 regex denial of service](https://junglewise.ai/threats/duplicate-advisory-ip-address-address6-matches-a-zone-identifier-in-9feed89f)
- [ip-address Address6 quadratic regex denial of service](https://junglewise.ai/threats/cve-2026-111997-ip-address-before-10-7-4-allows-a-denial-of-service-cpu)
- [ip-address Address6 isLinkLocal incomplete subnet check](https://junglewise.ai/threats/cve-2026-101913-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address logic error in subnet containment check](https://junglewise.ai/threats/cve-2026-101912-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address denial of service in Address6 constructor](https://junglewise.ai/threats/cve-2026-101911-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)