{"uuid": "cca4b5cc-99b3-43cd-a88e-ff2cdfd918ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101910", "type": "seen", "source": "https://gist.github.com/alon710/d44db51e720dfe6d0e35e26eb2a0926c", "content": "# CVE-2026-101910: CVE-2026-101910: Server-Side Request Forgery Bypass via NAT64 Local-Use Address Range in ip-address Library\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101910\n\n## Summary\nA validation bypass vulnerability exists in the npm package `ip-address` from version 10.2.0 to 10.5.1. The library's `Address6.isPrivate()` classifier fails to recognize the NAT64 local-use prefix range 64:ff9b:1::/48 as a restricted, private subnet. In networks implementing NAT64 routing configurations, an attacker can exploit this flaw to execute Server-Side Request Forgery (SSRF) and bypass local trust-boundary validations.\n\n## TL;DR\nThe `ip-address` library fails to identify the NAT64 local-use range 64:ff9b:1::/48 as private, enabling unauthenticated attackers to bypass SSRF validation checks and access internal network environments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918: Server-Side Request Forgery (SSRF)\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score / Percentile**: Not available / No active threat intel indicators\n- **Exploit Status**: poc\n- **KEV Status**: Not listed on CISA KEV\n\n## Affected Systems\n\n- Node.js environments implementing the `ip-address` npm package for hostname/IP resolution sanitization.\n- Containerized services operating in dual-stack IPv4/IPv6 networks utilizing NAT64 local-use prefix routing.\n- **ip-address**: >= 10.2.0, < 10.5.1 (Fixed in: `10.5.1`)\n\n## Mitigation\n\n- Upgrade the ip-address dependency to version 10.5.1 or higher.\n- Implement a manual subnet validation check on outbound IPv6 addresses using the 64:ff9b:1::/48 subnet mask.\n- Configure network security groups and ingress/egress rules to restrict outbound calls from critical microservices to NAT64 translators.\n\n**Remediation Steps:**\n1. Identify all projects and package files using the `ip-address` library within the scope of version 10.2.0 to 10.5.0.\n2. Execute `npm install ip-address@10.5.1` or modify the `package.json` lockfile to lock dependencies on version 10.5.1.\n3. Incorporate the NAT64 local-use check `64:ff9b:1::/48` in any localized IP classification wrappers if library upgrades cannot be completed immediately.\n4. Deploy network-level policies preventing application containers from querying internal network assets or sensitive endpoints like the Cloud Metadata API.\n\n## References\n\n- [NVD - CVE-2026-101910 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-101910)\n- [GitHub Security Advisory (GHSA-2vr4-cq9g-pvrc)](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc)\n- [ip-address Release Version Tag v10.5.1](https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101910) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T06:30:30.000000Z"}