{"uuid": "9fdad84a-8e03-46e8-b80d-b0db58b42627", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101912", "type": "seen", "source": "https://gist.github.com/alon710/695037b527e98708f813a603aa97604e", "content": "# CVE-2026-101912: CVE-2026-101912: Cross-Family IP Address Subnet Containment Logic Bypass in ip-address Library\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101912\n\n## Summary\nThe ip-address library is vulnerable to a logical bypass in its subnet containment methods. The functions isInSubnet() and isHostInSubnet() do not verify that compared addresses belong to the same IP family before performing masking checks. Under specific circumstances, an IPv6 address can share leading bit patterns with an IPv4 subnet, causing the containment check to evaluate as true. This allows attackers to bypass access control lists, firewalls, and server-side request forgery protection layers in applications relying on the library.\n\n## TL;DR\nA logical error in the ip-address library allows cross-family IP comparisons (IPv4 vs. IPv6) to collide. This enables attackers to bypass IP-based filters and access controls by submitting crafted IPv6 addresses that mimic private IPv4 subnets.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-697 / CWE-843\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 6.3 (Medium)\n- **EPSS Score**: 0.0037 (Percentile: 28.38%)\n- **Impact**: Partial Integrity (ACL/SSRF Filter Bypass)\n- **Exploit Status**: Proof-of-Concept (PoC) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications using the ip-address npm library\n- **ip-address**: < 10.7.1 (Fixed in: `10.7.1`)\n\n## Mitigation\n\n- Upgrade to ip-address v10.7.1 or later\n- Manually restrict address family processing on entry points\n- Add length constraints to raw IP parser inputs\n- Employ network-layer firewall configurations as defense-in-depth\n\n**Remediation Steps:**\n1. Identify vulnerable dependencies by running 'npm ls ip-address' or examining the yarn/pnpm lockfile.\n2. Update package.json dependencies to require 'ip-address': '^10.7.1'.\n3. Execute dependency updates inside the development environment to rebuild the lockfile.\n4. Deploy the updated build to production environments.\n\n## References\n\n- [GitHub Security Advisory (GHSA-j6r3-76f7-8jcv)](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv)\n- [Patch Commit](https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28)\n- [Release tag v10.7.1](https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1)\n- [NVD Record Details](https://nvd.nist.gov/vuln/detail/CVE-2026-101912)\n- [CVE.org Record Details](https://www.cve.org/CVERecord?id=CVE-2026-101912)\n- [Wiz Vulnerability Database Details](https://www.wiz.io/vulnerability-database/cve/cve-2026-101912)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101912) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T04:30:31.000000Z"}