beaugunderson/ip-address Security Advisories | GitStock

medium2026-10-22

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

GHSA-rxp7-6hxx-x8q5 · CVE-2026-111997

medium2026-09-29

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

GHSA-j6r3-76f7-8jcv · CVE-2026-101912

medium2026-09-29

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

GHSA-h3mg-xc3c-68pw · CVE-2026-101911

medium2026-09-28

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

GHSA-rpw4-54j3-4h4q · CVE-2026-101913

medium2026-09-28

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

GHSA-2vr4-cq9g-pvrc · CVE-2026-101910

high2026-08-03

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

GHSA-mwp4-54f8-5fhr · CVE-2026-69192

medium2026-08-03

ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

GHSA-4xrf-jv44-h6hh · CVE-2026-69198

medium2026-08-03

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

GHSA-22jq-vg5j-6vgg · CVE-2026-54272

medium2026-05-05

ip-address has XSS in Address6 HTML-emitting methods

GHSA-v2v4-37r5-5v8g · CVE-2026-42338