Executive brief
The 'ip-address' library, used for parsing and validating IP addresses in JavaScript applications, contains a flaw that allows internal network addresses to be misidentified as public ones. By appending a specific suffix (like /0) to an IP address, an attacker can trick security filters into allowing requests to sensitive internal systems, such as private databases or cloud management interfaces. This could lead to unauthorized access to internal data or services that were intended to be protected from the public internet.
Technical details
A vulnerability exists in the 'ip-address' library where special-use classification methods (e.g., isLoopback, isPrivate) rely on the 'isInSubnet' function, which incorrectly short-circuits to false if the input address's subnet mask is shorter than the reference range's mask. By providing an address with a CIDR suffix like '/0', an attacker can cause these checks to return false even for internal or restricted addresses. This allows for Server-Side Request Forgery (SSRF) bypasses in applications that use these methods to validate user-supplied IP addresses before making outbound requests. The issue affects both IPv4 and IPv6 addresses and was addressed in version 10.2.2 by introducing a classification logic that ignores the input's own prefix.
Affected products
- beaugunderson ip-address >= 10.1.1, <= 10.2.1
Timeline
- 2026-07-25: disclosed
- 2026-08-03: advisory: GitHub Advisory published
References
- https://api.github.com/users/hi-im-glitchless
- https://github.com/hi-im-glitchless
- https://api.github.com/users/hi-im-glitchless/gists%7B/gist_id%7D
- https://api.github.com/users/hi-im-glitchless/repos
- https://avatars.githubusercontent.com/u/163935836?v=4
- https://api.github.com/users/hi-im-glitchless/events%7B/privacy%7D