MEDIUM GitHub
CVE-2026-54272
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
### Summary
`Address6`'s special-property checks misclassify IPv4-mapped (`::ffff:0:0/96`) and NAT64 well-known (`64:ff9b::/96`) IPv6 addresses. These checks classify an address by its IPv6 wrapper rather than by the IPv4 address it embeds, so `isLoopback()`, `isLinkLocal()`, `isMulticast()`, and `isUnspecified()` all return `false` for literals such as `::ffff:127.0.0.1` or `::ffff:169.254.169.254` that actually route to loopback, RFC 1918, or link-local (cloud-metadata) destinations. `Address
Affected Products
- npm/ip-address >= 10.1.1, <= 10.2.0
References
- https://github.com/advisories/GHSA-22jq-vg5j-6vgg
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg
- https://nvd.nist.gov/vuln/detail/CVE-2026-54272
- https://github.com/beaugunderson/ip-address/commit/4a1f613f4c1bec915677dea923c10aaa09361ef
This medium severity vulnerability was published on 2026-08-03 via GitHub. Affected: npm/ip-address >= 10.1.1, <= 10.2.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.