Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-27T17:13:09 ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CWE-918

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

A flaw was found in the `ip-address` library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassification to bypass network restrictions and potentially access or manipulate internal resources. This vulnerability can be exploited on any dual-stack host for IPv4-mapped addresses, and for NAT64, it requires a NAT64/DNS64 gateway in the deployment network.

This is a Moderate flaw where the `ip-address` JavaScript library incorrectly classifies IPv4-mapped or NAT64 IPv6 addresses. This misclassification can lead to Server-Side Request Forgery (SSRF), allowing an attacker to bypass intended network restrictions and access internal resources. Exploitation is possible on dual-stack hosts for IPv4-mapped addresses, while NAT64 exploitation requires a NAT64/DNS64 gateway. Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-pccs Cryostat 4 Affected cryostat/cryostat-openshift-console-plugin-rhel9 Cryostat 4 Affected cryostat-openshift-console-plugin-npm Cryostat 4 Affected grafana-infinity-datasource-npm Exploit Intelligence Not affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-ui-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/console-mce-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/console-rhel9 Red Hat AMQ Broker 7 Affected ip-address Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/mcp-server-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-tech-preview/mcp-server-rhel9 Red Hat build of Apache Camel for Spring Boot 4 Not affected ip-address Red Hat build of Apache Camel - HawtIO 4 Affected ip-address Red Hat Build of Podman Desktop Affected rh-podman-desktop.git Red Hat Connectivity Link 1 Affected rhcl-1/rhcl-console-plugin-rhel9 Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Affected nodejs22 Red Hat Enterprise Linux 10 Affected nodejs24 Red Hat Enterprise Linux 10 Not affected rust Red Hat Enterprise Linux 8 Not affected nodejs:22/nodejs Red Hat Enterprise Linux 8 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Not affected rust Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/disk-image-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rust Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/udi-rhel9 Red Hat Satellite 6 Affected satellite/iop-remediations-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/automation-portal Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-54272 https://nvd.nist.gov/vuln/detail/CVE-2026-54272 https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg