Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-03T19:56:13 ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CWE-1389

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.

Red Hat Hardened Images 2026-08-05T00:00:00Z RHSA-2026:50826 grafana13-1-main-13.1.1-0.5.2.hum1 Red Hat Hardened Images 2026-08-05T00:00:00Z RHSA-2026:50854 grafana12-4-main-12.4.6-0.4.1.hum1 Red Hat Hardened Images 2026-08-06T00:00:00Z RHSA-2026:50956 grafana13-1-main-13.1.2-0.1.hum1 Red Hat Hardened Images 2026-08-06T00:00:00Z RHSA-2026:50969 grafana12-4-main-12.4.7-0.1.hum1 Cryostat 4 Affected cryostat/cryostat-openshift-console-plugin-rhel9 Cryostat 4 Affected cryostat-openshift-console-plugin-npm Cryostat 4 Affected grafana-infinity-datasource-npm Exploit Intelligence Affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Migration Toolkit for Applications 8 Under investigation mta/mta-cli-rhel9 Migration Toolkit for Applications 8 Under investigation mta/mta-generic-external-provider-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-ui-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/console-mce-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/console-rhel9 Red Hat AMQ Broker 7 Under investigation amq-broker-bin.zip Red Hat AMQ Broker 7 Under investigation amq-broker-maven-repository.zip Red Hat AMQ Broker 7 Affected ip-address Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/mcp-server-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-tech-preview/mcp-server-rhel9 Red Hat build of Apache Camel for Spring Boot 4 Not affected ip-address Red Hat build of Apache Camel for Spring Boot 4 Under investigation rhaf-camel-for-springboot-maven-repository.zip Red Hat build of Apache Camel for Spring Boot 4 Under investigation rhaf-camel-maven-repository.zip Red Hat build of Apache Camel for Spring Boot 4 Under investigation rhaf-camel-spring-boot-maven-repository.zip Red Hat build of Apache Camel - HawtIO 4 Affected ip-address Red Hat Build of Podman Desktop Affected rh-podman-desktop.git Red Hat Connectivity Link 1 Affected rhcl-1/rhcl-console-plugin-rhel9 Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-lightspeed Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Affected nodejs22 Red Hat Enterprise Linux 10 Affected nodejs24 Red Hat Enterprise Linux 10 Not affected rust Red Hat Enterprise Linux 10 Affected ubi10/nodejs-22 Red Hat Enterprise Linux 10 Affected ubi10/nodejs-22-minimal Red Hat Enterprise Linux 10 Affected ubi10/nodejs-24 Red Hat Enterprise Linux 10 Affected ubi10/nodejs-24-minimal Red Hat Enterprise Linux 10 Affected ubi10/s2i-base Red Hat Enterprise Linux 8 Affected nodejs:22/nodejs Red Hat Enterprise Linux 8 Affected nodejs:24/nodejs Red Hat Enterprise Linux 8 Affected ubi8/nodejs-22 Red Hat Enterprise Linux 8 Affected ubi8/nodejs-22-minimal Red Hat Enterprise Linux 8 Affected ubi8/nodejs-24 Red Hat Enterprise Linux 8 Affected ubi8/nodejs-24-minimal Red Hat Enterprise Linux 8 Affected ubi8/s2i-base Red Hat Enterprise Linux 9 Affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Not affected rust Red Hat Enterprise Linux 9 Affected ubi9/nodejs-22 Red Hat Enterprise Linux 9 Affected ubi9/nodejs-22-minimal Red Hat Enterprise Linux 9 Affected ubi9/nodejs-24 Red Hat Enterprise Linux 9 Affected ubi9/nodejs-24-minimal Red Hat Enterprise Linux 9 Affected ubi9/s2i-base Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rust Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/pluginregistry-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/udi-rhel9 Red Hat Satellite 6 Affected satellite/iop-remediations-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/automation-portal Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-69192 https://nvd.nist.gov/vuln/detail/CVE-2026-69192 https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1 https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr