# ip-address (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/ip-address Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/ip-address.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 10 vulnerabilities in ip-address (npm): 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, ip-address Address6 regex denial of service, was published on 18 October 2026. 2 vulnerabilities in the last four weeks, down 50% on the four before (4). ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 6 - All time: 10 (0 critical, 0 exploited in the wild) ## About ip-address (npm) JavaScript library for parsing, validating, and manipulating IPv4 and IPv6 addresses. ## Latest ip-address (npm) vulnerabilities - [ip-address Address6 regex denial of service](https://junglewise.ai/threats/duplicate-advisory-ip-address-address6-matches-a-zone-identifier-in-9feed89f) (medium, CVSS 4, published 18 Oct 2026) - [CVE-2026-111997: ip-address Address6 quadratic regex denial of service](https://junglewise.ai/threats/cve-2026-111997-ip-address-before-10-7-4-allows-a-denial-of-service-cpu) (medium, CVSS 4, published 18 Oct 2026) - [CVE-2026-101913: ip-address Address6 isLinkLocal incomplete subnet check](https://junglewise.ai/threats/cve-2026-101913-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101912: ip-address logic error in subnet containment check](https://junglewise.ai/threats/cve-2026-101912-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101911: ip-address denial of service in Address6 constructor](https://junglewise.ai/threats/cve-2026-101911-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101910: ip-address library Address6 trust boundary bypass via NAT64 range](https://junglewise.ai/threats/cve-2026-101910-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-69198: beaugunderson ip-address SSRF bypass via CIDR suffix masking](https://junglewise.ai/threats/cve-2026-69198-beaugunderson-ip-address-ssrf-bypass-via-cidr-suffix-masking) (medium, CVSS 4, published 3 Aug 2026) - [CVE-2026-69192: beaugunderson ip-address SSRF via improper leading-zero octal decoding](https://junglewise.ai/threats/cve-2026-69192-beaugunderson-ip-address-ssrf-via-improper-leading-zero-octal) (high, CVSS 7.7, published 3 Aug 2026) - [CVE-2026-54272: beaugunderson ip-address SSRF via address misclassification](https://junglewise.ai/threats/cve-2026-54272-beaugunderson-ip-address-ssrf-via-address-misclassification) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-42338: beaugunderson ip-address XSS in Address6 HTML-emitting methods](https://junglewise.ai/threats/cve-2026-42338-beaugunderson-ip-address-xss-in-address6-html-emitting-methods) (medium, CVSS 6.1, published 12 May 2026) ## Most severe ip-address (npm) vulnerabilities - [CVE-2026-69192: beaugunderson ip-address SSRF via improper leading-zero octal decoding](https://junglewise.ai/threats/cve-2026-69192-beaugunderson-ip-address-ssrf-via-improper-leading-zero-octal) (high, CVSS 7.7, published 3 Aug 2026) - [CVE-2026-42338: beaugunderson ip-address XSS in Address6 HTML-emitting methods](https://junglewise.ai/threats/cve-2026-42338-beaugunderson-ip-address-xss-in-address6-html-emitting-methods) (medium, CVSS 6.1, published 12 May 2026) - [CVE-2026-69198: beaugunderson ip-address SSRF bypass via CIDR suffix masking](https://junglewise.ai/threats/cve-2026-69198-beaugunderson-ip-address-ssrf-bypass-via-cidr-suffix-masking) (medium, CVSS 4, published 3 Aug 2026) - [CVE-2026-54272: beaugunderson ip-address SSRF via address misclassification](https://junglewise.ai/threats/cve-2026-54272-beaugunderson-ip-address-ssrf-via-address-misclassification) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-101913: ip-address Address6 isLinkLocal incomplete subnet check](https://junglewise.ai/threats/cve-2026-101913-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101910: ip-address library Address6 trust boundary bypass via NAT64 range](https://junglewise.ai/threats/cve-2026-101910-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101912: ip-address logic error in subnet containment check](https://junglewise.ai/threats/cve-2026-101912-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101911: ip-address denial of service in Address6 constructor](https://junglewise.ai/threats/cve-2026-101911-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-111997: ip-address Address6 quadratic regex denial of service](https://junglewise.ai/threats/cve-2026-111997-ip-address-before-10-7-4-allows-a-denial-of-service-cpu) (medium, CVSS 4, published 18 Oct 2026) - [ip-address Address6 regex denial of service](https://junglewise.ai/threats/duplicate-advisory-ip-address-address6-matches-a-zone-identifier-in-9feed89f) (medium, CVSS 4, published 18 Oct 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 50% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 4 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "ip-address (npm) vulnerabilities", https://junglewise.ai/threats/technologies/ip-address, 13 November 2026.