CVE-2026-69198: ip-address Library SSRF Vulnerability

CVE-2026-69198 Overview

CVE-2026-69198 affects the ip-address JavaScript library, a widely used package for parsing and manipulating IPv4 and IPv6 addresses. Versions from 10.1.1 up to (but not including) 10.2.2 contain a flaw in every special-use classification method, including isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType(). Attackers can append a CIDR suffix such as /0 to an input to suppress classification entirely. Applications that rely on these checks to enforce network trust boundaries, notably Server-Side Request Forgery (SSRF) filters, may treat internal targets as external and forward the request. The issue is fixed in version 10.2.2.

Critical Impact
Attackers can bypass SSRF protections that use ip-address classifiers, reaching internal services such as cloud metadata endpoints, localhost APIs, and private network hosts.

Affected Products

ip-address npm package versions 10.1.1 through 10.2.1
Node.js applications using ip-address classifiers for SSRF filtering
Downstream libraries and services that wrap ip-address for network trust decisions

Discovery Timeline

2026-08-03 - CVE-2026-69198 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69198

Vulnerability Analysis

The flaw is an input validation weakness [CWE-20] in the shared isInSubnet helper. Every special-use classifier in the library delegates to this helper to test whether a parsed address falls inside a reference range such as 127.0.0.0/8 or 10.0.0.0/8. The helper begins with a containment guard that short-circuits to false whenever the parsed address's own subnetMask is shorter than the reference range's mask. That guard is appropriate for asking whether one network contains another, but wrong for asking whether a single host falls inside a range.

Because the subnetMask value comes verbatim from the CIDR suffix on the parsed input, an attacker who controls the input string can set it arbitrarily. Supplying 127.0.0.1/0 forces subnetMask to 0, which is shorter than any reference range mask, so every classifier returns false. Meanwhile, correctForm() and the raw address field still resolve to the actual internal target, so downstream HTTP clients dial the internal address unimpeded.

Root Cause

The defect is that the containment guard sits in the classification path. The underlying mask(n) primitive already returns the first n bits of the full parsed address independently of subnetMask, so the bit comparison itself is correct. The patch introduces a new isHostInSubnet primitive that ignores the address's own subnet mask, and rewires every classifier to call it instead of isInSubnet.

Attack Vector

An attacker submits a URL or hostname containing an IP literal with a CIDR suffix, for example http://127.0.0.1/0/admin or a parameter such as ?target=10.0.0.1/0. When the receiving application parses the address with ip-address and calls isPrivate() or isLoopback() to enforce an SSRF allowlist, the classifier returns false. The application then forwards the request to the internal target, potentially reaching cloud instance metadata services, internal admin panels, or private APIs.

typescript

// Patch excerpt from src/common.ts
export function isInSubnet(this: Address4 | Address6, address: Address4 | Address6) {
  if (this.subnetMask < address.subnetMask) {
    return false;
  }

  return isHostInSubnet.call(this, address);
}

/**
 * Returns whether this address's host bits fall inside `address`, ignoring
 * this address's own subnet mask.
 *
 * This is the primitive the special-use classifiers (`isLoopback`, ...)
 * now call directly.
 */

Source: GitHub commit 488fe9bc

typescript

// Patch excerpt from src/ipv4.ts - classifiers now use isHostInSubnet
isHostInSubnet = common.isHostInSubnet;

isMulticast(): boolean {
  return this.isHostInSubnet(MULTICAST_V4);
}

isPrivate(): boolean {
  return PRIVATE_V4.some((subnet) => this.isHostInSubnet(subnet));
}

Source: GitHub commit 488fe9bc

Detection Methods for CVE-2026-69198

Indicators of Compromise

Outbound HTTP requests from application servers to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback 127.0.0.0/8 that originate from user-controlled URL parameters.
Access log entries containing IP literals with CIDR suffixes such as /0, /1, or /8 in user-supplied URL, host, or callback fields.
Requests to cloud metadata endpoints such as 169.254.169.254 from workloads that do not normally consume metadata.

Detection Strategies

Perform Software Composition Analysis (SCA) across Node.js projects to flag ip-address versions between 10.1.1 and 10.2.1 inclusive.
Add web application firewall (WAF) rules that reject user-supplied URLs where the host portion is an IP literal followed by a / and a digit.
Instrument SSRF filter code paths to log both the raw input and the classifier verdict, then alert on any verdict that contradicts a downstream connection destination.

Monitoring Recommendations

Monitor egress traffic from web tiers for connections to internal subnets and cloud metadata services, correlating source process with recent inbound HTTP requests.
Track dependency manifests (package.json, package-lock.json, yarn.lock) in CI for the vulnerable ip-address range and fail builds until upgraded.
Baseline expected outbound destinations per service and alert on deviations that coincide with parsed-URL inputs.

How to Mitigate CVE-2026-69198

Immediate Actions Required

Upgrade ip-address to version 10.2.2 or later in all Node.js projects and rebuild deployed artifacts.
Audit application code for calls to isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() used inside SSRF or trust-boundary checks.
After upgrading, migrate those checks to the new isHostInSubnet primitive where the intent is to classify a single host regardless of any CIDR suffix.

Patch Information

The fix is available in ip-address version 10.2.2. See the GitHub Release v10.2.2 and GitHub Security Advisory GHSA-4xrf-jv44-h6hh for full details. The corrective code change is captured in GitHub commit 488fe9bc.

Workarounds

Reject any user-supplied URL whose host component contains a / character before parsing, eliminating CIDR-suffix inputs entirely.
Strip or normalize the CIDR suffix from parsed addresses before invoking classification methods, for example by re-parsing address.correctForm() without a suffix.
Enforce SSRF protection at the network layer by blocking egress from application workloads to RFC1918, loopback, link-local, and cloud metadata ranges.

bash

# Upgrade using npm
npm install ip-address@^10.2.2

# Verify installed version
npm ls ip-address

# Audit for vulnerable versions across a workspace
npm ls ip-address --all | grep -E 'ip-address@10\.(1\.[1-9]|2\.[01])'