CVE-2026-69198 in ip-address
Summary
by MITRE • 08/03/2026
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The ip-address library vulnerability represents a critical flaw in network address classification logic that fundamentally undermines security decisions based on IP address properties. This vulnerability affects versions 10.1.1 through 10.2.2 where special-use classification methods rely on the isInSubnet function, which implements an incorrect short-circuiting mechanism that bypasses proper address validation. The core technical issue stems from how CIDR suffixes are processed within the library's internal parsing logic, specifically when addresses are appended with extremely short subnet masks such as /0. This deliberate truncation of subnet mask length causes the classification functions to return false positives, effectively neutralizing all special-use address detection capabilities.
The operational impact of this vulnerability extends beyond simple misclassification, creating dangerous security implications for applications that depend on accurate IP address categorization for network boundary enforcement. When an application performs SSRF (Server-Side Request Forgery) protection by checking if an address falls within private or loopback ranges using methods like isLoopback(), isPrivate(), or isLinkLocal(), the vulnerability allows malicious actors to bypass these security checks entirely. The flaw manifests because the containment guard that should verify address inclusion within reference ranges operates before proper mask validation, causing legitimate internal addresses to appear as external targets to the application's trust boundary logic.
This vulnerability aligns with CWE-254 and follows patterns commonly seen in input validation flaws that affect network security controls, where incorrect handling of edge cases in parsing logic leads to bypassable security mechanisms. The issue demonstrates how seemingly minor implementation details in network libraries can create substantial security gaps, particularly affecting ATT&CK techniques related to privilege escalation through network boundary bypasses and resource access manipulation. The fact that correctForm() and address methods still return accurate values while classification methods fail creates a misleading interface that makes detection particularly challenging for security-conscious developers who may not immediately recognize the inconsistency in the library's behavior.
The technical root cause lies in the improper interaction between mask validation and classification logic, where mask(n) correctly returns the first n bits of an address but the isInSubnet function fails to properly account for subnet mask length comparisons when dealing with extremely short CIDR suffixes. The fix implemented in version 10.2.2 addresses this by ensuring proper containment verification before classification decisions are made, maintaining the underlying bit comparison accuracy while correcting the flawed short-circuiting behavior that allowed /0 and similar suffixes to completely bypass address classification checks.
This vulnerability underscores the importance of comprehensive testing for edge cases in network security libraries and demonstrates how subtle implementation flaws can create exploitable conditions in applications that rely on IP address categorization for access control decisions. The security implications are particularly severe for web applications that accept user-provided URLs or network addresses, as attackers could potentially craft requests that appear to target external resources while actually accessing internal systems through the bypassed classification checks. Organizations utilizing this library should prioritize immediate upgrade to version 10.2.2 or later to prevent exploitation of this vulnerability in their security controls.