https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 14:18:53 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-101913 <p>ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.</p> <p>ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-101913 https://vulnerability.circl.lu/vuln/ghsa-rpw4-54j3-4h4q <p><strong>Affected:</strong> npm: ip-address</p> <p>### Summary</p> <p>`Address6.isLinkLocal()` recognizes `fe80::/64` rather than `fe80::/10`. Link-local unicast is the whole `/10` under RFC 4291 §2.4 and the IANA IPv6 Special-Purpose Address Registry, so the method returns `false` for every link-local address outside the one `/64` that stateless address autoconfiguration happens to use. `new Address6(&#39;fe81::1&#39;).isLinkLocal()` is `false`.</p> <p>The library contradicts itself on the same object: for `fe81::1`, `getType()` returns `&#39;Link-local unicast&#39;`, `getScope()` returns `&#39;Link local&#39;`, and `isHostInSubnet(new Address6(&#39;fe80::/10&#39;))` returns `true`, while `isLinkLocal()` returns `false`.</p> <p>An application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) will classify a link-local target as unremarkable and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach.</p> <p>### Details</p> <p>`isLinkLocal()` in `src/ipv6.ts` compares the first 64 bits of the address against a literal string:</p> <p>```ts // Zeroes are required, i.e. we can&#39;t check isHostInSubnet with &#39;fe80::/10&#39; if ( this.getBitsBase2(0, 64) === &#39;1111111010000000000000000000000000000000000000000000000000000000&#39; ) { return true; } ```</p> <p>The comparison requires the first 64 bits to be exactly `fe80:0000:0000:0000`, so it accepts 2⁶⁴ of the 2¹¹⁸ addresses in `fe80::/10`. The comment sta…</p> <p><strong>Affected:</strong> npm: ip-address</p> <p>### Summary</p> <p>`Address6.isLinkLocal()` recognizes `fe80::/64` rather than `fe80::/10`. Link-local unicast is the whole `/10` under RFC 4291 §2.4 and the IANA IPv6 Special-Purpose Address Registry, so the method returns `false` for every link-local address outside the one `/64` that stateless address autoconfiguration happens to use. `new Address6(&#39;fe81::1&#39;).isLinkLocal()` is `false`.</p> <p>The library contradicts itself on the same object: for `fe81::1`, `getType()` returns `&#39;Link-local unicast&#39;`, `getScope()` returns `&#39;Link local&#39;`, and `isHostInSubnet(new Address6(&#39;fe80::/10&#39;))` returns `true`, while `isLinkLocal()` returns `false`.</p> <p>An application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) will classify a link-local target as unremarkable and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach.</p> <p>### Details</p> <p>`isLinkLocal()` in `src/ipv6.ts` compares the first 64 bits of the address against a literal string:</p> <p>```ts // Zeroes are required, i.e. we can&#39;t check isHostInSubnet with &#39;fe80::/10&#39; if ( this.getBitsBase2(0, 64) === &#39;1111111010000000000000000000000000000000000000000000000000000000&#39; ) { return true; } ```</p> <p>The comparison requires the first 64 bits to be exactly `fe80:0000:0000:0000`, so it accepts 2⁶⁴ of the 2¹¹⁸ addresses in `fe80::/10`. The comment sta…</p> https://vulnerability.circl.lu/vuln/ghsa-rpw4-54j3-4h4q