CVE-2026-101910
Description
A flaw was found in ip-address. The address classification mechanism fails to identify the local-use Network Address Translation (NAT64) range as private. A remote attacker can exploit this by submitting an internal address formatted within this IPv6 prefix to an application that relies on the library to enforce network boundaries. Successful exploitation allows an attacker to bypass network access controls, potentially resulting in Server-Side Request Forgery (SSRF) and unauthorized access to restricted internal services.
Statement
A flaw of moderate impact was found in the ip-address JavaScript library, which is bundled in Red Hat Hardened Images (Hummingbird) components grafana12.4, grafana13.1, and grafana13.2. In ip-address versions 10.2.0 through 10.5.0, the Address6 address classifiers do not recognize the NAT64 local-use range 64:ff9b:1::/48 (RFC 8215): isPrivate(), isLoopback(), and isLinkLocal() all return false for addresses in that range, so an internal IPv4 destination encoded through an operator-selected NAT64 prefix within it is treated as an ordinary global address. A remote attacker who can submit such an address to an application that relies on ip-address for network trust-boundary decisions, such as a Server-Side Request Forgery (SSRF) filter, can cause an internal target to be classified as external, bypassing network access controls and enabling SSRF and unauthorized access to restricted internal services such as loopback services or cloud metadata endpoints. Exploitation requires the server's network to run a NAT64 translator on a prefix inside 64:ff9b:1::/48 and requires the attacker to know or guess the deployed prefix. Red Hat Product Security rates this flaw Moderate severity with a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); the upstream CVSS 4.0 score of 6.9 is higher mainly because upstream scores the NAT64 deployment precondition as high attack complexity and the trust-boundary crossing as a changed security scope. Within Red Hat, this flaw is tracked against the Red Hat Hardened Images components grafana12.4, grafana13.1, and grafana13.2 with resolution delegated to the image maintainers; the delegated assessment determined the shipped builds not affected because the vulnerable code is not present, and the associated trackers were closed as Not a Bug.
Mitigation
The upstream project documents an interim workaround for applications that cannot upgrade immediately: explicitly test submitted IPv6 addresses for membership in the NAT64 local-use range 64:ff9b:1::/48 and reject them at the application's trust-boundary check. Using the library itself, this can be done with: const NAT64_LOCAL_USE = new Address6('64:ff9b:1::/48'); const localUse = new Address6(host).isHostInSubnet(NAT64_LOCAL_USE); and blocking the request when the check returns true. This issue is fixed upstream in ip-address 10.5.1 and later, where isPrivate() returns true for every address in 64:ff9b:1::/48, so upgrading to the patched release removes the need for the workaround. Note that these address classifiers are not a complete SSRF defense on their own; a robust guard should also resolve hostnames and validate the resolved IP address at the point of connection, accounting for DNS rebinding and redirects.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
