https://vulnerability.circl.lu/sightings/feed 2026-09-29T22:30:09.597771+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7d2640d1-e49b-4646-b62c-4a8b23f2dff0/export 2026-09-29T22:30:09.631396+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "7d2640d1-e49b-4646-b62c-4a8b23f2dff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101910", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwnrsflezg2l", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-101910 impacts ip-address in 3 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/696\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-09-29T12:01:19.260602Z"} 2026-09-29T12:01:19.260602+00:00 https://vulnerability.circl.lu/sighting/cca4b5cc-99b3-43cd-a88e-ff2cdfd918ec/export 2026-09-29T22:30:09.633095+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "cca4b5cc-99b3-43cd-a88e-ff2cdfd918ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101910", "type": "seen", "source": "https://gist.github.com/alon710/d44db51e720dfe6d0e35e26eb2a0926c", "content": "# CVE-2026-101910: CVE-2026-101910: Server-Side Request Forgery Bypass via NAT64 Local-Use Address Range in ip-address Library\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101910\n\n## Summary\nA validation bypass vulnerability exists in the npm package `ip-address` from version 10.2.0 to 10.5.1. The library's `Address6.isPrivate()` classifier fails to recognize the NAT64 local-use prefix range 64:ff9b:1::/48 as a restricted, private subnet. In networks implementing NAT64 routing configurations, an attacker can exploit this flaw to execute Server-Side Request Forgery (SSRF) and bypass local trust-boundary validations.\n\n## TL;DR\nThe `ip-address` library fails to identify the NAT64 local-use range 64:ff9b:1::/48 as private, enabling unauthenticated attackers to bypass SSRF validation checks and access internal network environments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918: Server-Side Request Forgery (SSRF)\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score / Percentile**: Not available / No active threat intel indicators\n- **Exploit Status**: poc\n- **KEV Status**: Not listed on CISA KEV\n\n## Affected Systems\n\n- Node.js environments implementing the `ip-address` npm package for hostname/IP resolution sanitization.\n- Containerized services operating in dual-stack IPv4/IPv6 networks utilizing NAT64 local-use prefix routing.\n- **ip-address**: >= 10.2.0, < 10.5.1 (Fixed in: `10.5.1`)\n\n## Mitigation\n\n- Upgrade the ip-address dependency to version 10.5.1 or higher.\n- Implement a manual subnet validation check on outbound IPv6 addresses using the 64:ff9b:1::/48 subnet mask.\n- Configure network security groups and ingress/egress rules to restrict outbound calls from critical microservices to NAT64 translators.\n\n**Remediation Steps:**\n1. Identify all projects and package files using the `ip-address` library within the scope of version 10.2.0 to 10.5.0.\n2. Execute `npm install ip-address@10.5.1` or modify the `package.json` lockfile to lock dependencies on version 10.5.1.\n3. Incorporate the NAT64 local-use check `64:ff9b:1::/48` in any localized IP classification wrappers if library upgrades cannot be completed immediately.\n4. Deploy network-level policies preventing application containers from querying internal network assets or sensitive endpoints like the Cloud Metadata API.\n\n## References\n\n- [NVD - CVE-2026-101910 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-101910)\n- [GitHub Security Advisory (GHSA-2vr4-cq9g-pvrc)](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc)\n- [ip-address Release Version Tag v10.5.1](https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101910) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T06:30:30.000000Z"} 2026-09-29T06:30:30+00:00 https://vulnerability.circl.lu/sighting/2a39c831-de47-4a6b-8466-3915e7af6155/export 2026-09-29T22:30:09.633259+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "2a39c831-de47-4a6b-8466-3915e7af6155", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-101910", "type": "published-proof-of-concept", "source": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc", "content": "", "creation_timestamp": "2026-08-29T03:32:59.000000Z"} 2026-08-29T03:32:59+00:00