CVE-2026-101913 in ip-address
Summary
by MITRE • 09/28/2026
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The ip-address library serves as a foundational utility for parsing and manipulating IPv4 and IPv6 addresses within JavaScript environments, often utilized by web applications to validate network configurations or enforce security policies based on address types. A critical logical flaw exists in the implementation of the Address6 class, specifically within the isLinkLocal method found in src/ipv6.ts prior to version 10.5.1. This vulnerability stems from an incomplete range check where the function incorrectly identifies link-local addresses by only recognizing the fe80::/64 subnet rather than the full IANA-assigned IPv6 link-local address space defined as fe80::/10. This discrepancy creates a significant inconsistency in how IP addresses are classified, particularly when compared against other methods within the same class such as getType and getScope, which correctly identify the broader range of link-local addresses.
From a technical perspective, this misclassification allows an attacker to bypass trust-boundary checks that rely on the isLinkLocal method for validation purposes. In many security architectures, applications distinguish between global unicast addresses and link-local addresses because they operate under different assumptions regarding reachability and routing scope. Link-local addresses are intended for communication within a single network segment and should not be routed beyond the local physical or logical link. By exploiting this logic error, an attacker can supply an IPv6 address that falls within the fe80::/10 range but outside of the narrower fe80::/64 block. The application will incorrectly classify this address as non-link-local based on the flawed isLinkLocal check, while other internal mechanisms may still recognize it as link-local due to the correct implementation in getType and getScope.
The operational impact of this vulnerability is substantial, particularly for applications that enforce security policies based on IP classification. If a system uses the isLinkLocal method to determine whether traffic should be allowed from external sources or to restrict access to internal services, an attacker can craft requests using addresses like fe80::1:2:3:4 (which are valid link-local addresses) to evade these restrictions. This bypass effectively allows unauthorized access to on-link hosts that were intended to remain isolated behind trust boundaries. The inconsistency in classification further complicates mitigation efforts because different parts of the application may behave unpredictably when processing such addresses, leading to potential race conditions or logic errors that an attacker can leverage for privilege escalation or data exfiltration within the local network segment.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-841 Improper Enforcement of Behavioral Restrictions, as it involves a failure to correctly validate input against defined security policies due to incomplete range checking. In terms of the MITRE ATT&CK framework, this flaw facilitates lateral movement or unauthorized access by allowing an adversary to bypass network-level controls that rely on IP address classification for segmentation and isolation. The exploitation does not require complex buffer overflows or memory corruption but rather a simple logical manipulation of input data, highlighting the importance of rigorous validation logic in security-critical libraries.
To mitigate this vulnerability, organizations must immediately upgrade the ip-address library to version 10.5.1 or later, where the isLinkLocal method has been corrected to properly recognize the entire fe80::/10 range as link-local. For environments that cannot update immediately due to dependency constraints, a temporary workaround involves implementing custom validation logic at the application layer to manually check for addresses within the full IPv6 link-local prefix before relying on the library's built-in methods. Additionally, developers should audit other uses of IP classification functions within their codebase to ensure consistency across all trust-boundary checks and consider adopting defense-in-depth strategies that do not rely solely on client-supplied or parsed address types for security decisions.