CVE-2026-69192 (Medium) detected in ip-address-10.0.1.tgz

[mend-bolt-for-github]

CVE-2026-69192 - Medium Severity Vulnerability

Vulnerable Library - ip-address-10.0.1.tgz

A library for parsing IPv4 and IPv6 IP addresses in node and the browser.

Library home page: https://registry.npmjs.org/ip-address/-/ip-address-10.0.1.tgz

Sample Path to Dependency File: /devel/electron39/files/packagejsons/package.json

Path to vulnerable library: /devel/electron39/files/packagejsons/package.json

Dependency Hierarchy:

• @⁠electron-ci/is-valid-window-0.0.5.tgz (Root Library)
  • nan-2.23.0.tgz
    • node-gyp-11.5.0.tgz
      • make-fetch-happen-14.0.3.tgz
        • agent-3.0.0.tgz
          • socks-proxy-agent-8.0.5.tgz
            • socks-2.8.7.tgz
              • ❌ ip-address-10.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 25cf57a93f385839bd7e68424038ff713426e4e9

Found in base branch: master

Vulnerability Details

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Publish Date: 2026-08-03

URL: CVE-2026-69192

CVSS 3 Score Details (5.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-03

Fix Resolution: https://github.com/beaugunderson/ip-address.git - v10.3.1

---

Step up your Open Source Security Game with Mend here