Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-03T19:59:05 ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-1389

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing (CIDR) suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such as those designed to prevent Server-Side Request Forgery (SSRF), to incorrectly treat internal network targets as external. Consequently, an attacker may be able to access internal resources or bypass other network trust-boundary checks.

Red Hat products that ship the affected ip-address library versions use it in browser-side UI components for IP address display and form validation, not for server-side request filtering or SSRF protection. The classification bypass has no security-relevant effect in this context because no trust-boundary decisions are built on these client-side checks. Validate and sanitize CIDR suffixes on IP address input before passing them to the ip-address library. Reject any user-supplied address where the prefix length is outside the valid range for the address family (0-32 for IPv4, 0-128 for IPv6) or where the prefix length contradicts the intended classification check. Applications that rely on ip-address for SSRF filtering should add an independent server-side check that does not depend on the library's classification methods. Red Hat Hardened Images 2026-08-01T00:00:00Z RHSA-2026:49401 grafana12-4-main-12.4.6-0.3.hum1 Red Hat Hardened Images 2026-08-05T00:00:00Z RHSA-2026:50826 grafana13-1-main-13.1.1-0.5.2.hum1 Cryostat 4 Fix deferred cryostat/cryostat-openshift-console-plugin-rhel9 Cryostat 4 Not affected cryostat-openshift-console-plugin-npm Cryostat 4 Not affected grafana-infinity-datasource-npm Exploit Intelligence Out of support scope exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Migration Toolkit for Containers Fix deferred rhmtc/openshift-migration-ui-rhel8 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/console-mce-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/console-rhel9 Red Hat AMQ Broker 7 Fix deferred ip-address Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/mcp-server-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-tech-preview/mcp-server-rhel9 Red Hat build of Apache Camel for Spring Boot 4 Fix deferred ip-address Red Hat build of Apache Camel - HawtIO 4 Fix deferred ip-address Red Hat Build of Podman Desktop Fix deferred rh-podman-desktop.git Red Hat Connectivity Link 1 Fix deferred rhcl-1/rhcl-console-plugin-rhel9 Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-lightspeed Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator Red Hat Developer Hub Fix deferred rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Fix deferred nodejs22 Red Hat Enterprise Linux 10 Fix deferred nodejs24 Red Hat Enterprise Linux 10 Fix deferred rust Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-22 Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-22-minimal Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-24 Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-24-minimal Red Hat Enterprise Linux 10 Fix deferred ubi10/s2i-base Red Hat Enterprise Linux 8 Fix deferred nodejs:24/nodejs Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-22 Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-22-minimal Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-24 Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-24-minimal Red Hat Enterprise Linux 8 Fix deferred ubi8/s2i-base Red Hat Enterprise Linux 9 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:24/nodejs Red Hat Enterprise Linux 9 Fix deferred rust Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-22 Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-22-minimal Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-24 Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-24-minimal Red Hat Enterprise Linux 9 Fix deferred ubi9/s2i-base Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/disk-image-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rust Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/pluginregistry-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/udi-rhel9 Red Hat Satellite 6 Fix deferred satellite/iop-remediations-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/automation-portal Self-service automation portal 2 Fix deferred ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-69198 https://nvd.nist.gov/vuln/detail/CVE-2026-69198 https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2 https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh