CVE-2026-69198: beaugunderson ip-address SSRF bypass via CIDR suffix masking

CVE-2026-69198 · Severity: medium · CVSS 4 · Published 2026-08-03

The ip-address library is used by applications to validate and classify IP addresses, including identifying internal addresses for security policies. A flaw in versions 10.1.1 through 10.2.1 allows attackers to append a CIDR suffix (e.g., "/0") to an IP address, causing the library to misclassify internal addresses as external. This bypasses SSRF (Server-Side Request Forgery) filters and trust-boundary checks, potentially allowing unauthorized access to internal services like cloud metadata endpoints or loopback services.

Technologies: ip-address (npm). Vendors: npm.

Quick answers

Is CVE-2026-69198 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69198 being exploited in the wild.
How severe is CVE-2026-69198?
Medium severity, with a CVSS score of 4, published 3 August 2026.
Which products and versions are affected?
ip-address (npm) >= 10.1.1, <= 10.2.1, SEMVER:introduced=10.1.1,fixed=10.2.2.
Is there a fix for CVE-2026-69198?
Yes. ip-address (npm): upgrade to 10.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69198 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-69198?
Check whether you run ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ip-address (npm): upgrade to 10.2.2 or later
    npm install ip-address@10.2.2

Technical details

The vulnerability stems from the `isInSubnet()` function in src/common.ts, which short-circuits to false when the receiver's subnet mask is shorter than the reference range's mask. All special-use classifiers (isLoopback, isPrivate, isLinkLocal, isCGNAT, isMulticast, isUnspecified, isBroadcast, isULA, and getType) rely on this function. When a CIDR suffix like "/0" is appended to an internal IP (e.g., "127.0.0.1/0" or "10.0.0.5/7"), the prefix comparison returns false before any actual bit comparison occurs, causing the classifier to report the internal address as external. However, the address's host bits and correctForm() output remain intact, so connections still reach the intended internal target. Exploitation requires an application that accepts bare address strings with suffixes and passes them to the constructor before classifying—such as allow/deny lists, webhook targets, or proxy destinations. A CIDR suffix is not legal in standard URL hosts, so most URL-based SSRF vectors are not affected. The fix, available in version 10.2.2, introduces `isHostInSubnet()` to classify based on the address's host bits independently of the CIDR suffix.

Affected products

  • beaugunderson ip-address 10.1.1 to 10.2.1

Identifiers

  • CVE-2026-69198
  • GHSA-4xrf-jv44-h6hh

Timeline

  • 2026-07-25: disclosed
  • 2026-07-24: patched: version 10.2.2
  • 2026-08-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.