{"vulnerability": "CVE-2026-6919", "sightings": [{"uuid": "b81f8164-0c86-4f6e-bbee-17f97cc7cb84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6919", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116455423009127074", "content": "", "creation_timestamp": "2026-04-23T18:25:35.317486Z"}, {"uuid": "875539a0-3e4f-4bc5-8c58-d21399e5fa52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6919", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkj45qfh4s23", "content": "", "creation_timestamp": "2026-04-27T22:21:00.595680Z"}, {"uuid": "f4c615ea-6150-4bbd-9272-ae6fb20c718a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6919", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mke5fvuern2w", "content": "", "creation_timestamp": "2026-04-25T23:00:08.827834Z"}, {"uuid": "53a8a7a4-184a-4705-8a44-204e61548257", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6919", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mke5fwwihm2e", "content": "", "creation_timestamp": "2026-04-25T23:00:09.655974Z"}, {"uuid": "6cdf602c-8465-4156-822e-6b5196812eef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6919", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/chromeos-multiple-vulnerabilities_20260428", "content": "", "creation_timestamp": "2026-04-27T20:00:00.000000Z"}, {"uuid": "8b5ef0e8-f309-4661-aa99-3ad7bd82b468", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6919", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mkffqvi32o22", "content": "", "creation_timestamp": "2026-04-26T11:02:06.633720Z"}, {"uuid": "b281dad9-45ba-4f65-89ac-b35a6346977b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6919", "type": "seen", "source": "Telegram/9MQPqn6NQB4yNQwBhEjQmfZAQamilmjjvNDDQhjtzrN-0VE", "content": "", "creation_timestamp": "2026-04-24T15:22:14.000000Z"}, {"uuid": "f68d2ea5-710d-4806-a25b-e6889facd90d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69198", "type": "seen", "source": "https://gist.github.com/alon710/7d8f1377f69b3f931098d4cd17c3c6cd", "content": "# CVE-2026-69198: CVE-2026-69198: Server-Side Request Forgery Bypass via CIDR Suffix in ip-address Library\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69198\n\n## Summary\nAn input validation vulnerability in the npm package `ip-address` allows unauthenticated remote attackers to bypass Server-Side Request Forgery (SSRF) protections by appending a `/0` CIDR suffix to IP address strings. This causes the library's classification helper functions to incorrectly identify internal addresses as public, external addresses, while normalization helpers resolve the address back to its internal form during network connection establishment.\n\n## TL;DR\nA design flaw in the `ip-address` library's classification logic allows attackers to bypass SSRF filters. Adding a `/0` suffix short-circuits internal checks, making local/private IPs look public.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20, CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.9 (Medium)\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not Listed\n- **Impact**: Server-Side Request Forgery Bypass\n\n## Affected Systems\n\n- Node.js applications using `ip-address` version >= 10.1.1 and < 10.2.2 for input validation and SSRF defenses\n- **ip-address**: >= 10.1.1, < 10.2.2 (Fixed in: `10.2.2`)\n\n## Mitigation\n\n- Upgrade ip-address library to 10.2.2 or higher.\n- Sanitize user input to strip CIDR suffixes before passing to parsing libraries.\n- Use network-level firewalls to enforce SSRF egress blocks independent of application code.\n\n**Remediation Steps:**\n1. Identify all applications utilizing the `ip-address` npm package.\n2. Update `package.json` to reference version `^10.2.2`.\n3. Execute `npm install` or `yarn install` to apply the update.\n4. Validate that IP classification functions reject loopback and private blocks even with trailing suffixes.\n\n## References\n\n- [GitHub Security Advisory GHSA-4xrf-jv44-h6hh](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh)\n- [Fix Commit 488fe9bc7c35363b4b090494fc38c266d217740d](https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d)\n- [GitHub Release v10.2.2](https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69198) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T09:31:38.438111Z"}, {"uuid": "d9241a99-29cd-4502-8344-c9b986165302", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69198", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxo73ngs2j", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-69198 impacts ip-address in 2 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/643\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:00:57.464326Z"}, {"uuid": "1766509e-cd0a-47c1-9eaa-061b1d2aab29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69192", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxo3zmbc2o", "content": "\n\ud83d\udea8 New HIGH CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-69192 impacts ip-address in 3 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/641\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:00:54.244432Z"}, {"uuid": "d0cd60c4-8f24-4369-b1fd-b714456e6b43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69192", "type": "seen", "source": "https://gist.github.com/alon710/572dbe4f17925376407c061da3100fba", "content": "# CVE-2026-69192: CVE-2026-69192: SSRF Bypass via Parser Differential (Octal vs Decimal) in ip-address JavaScript Library\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69192\n\n## Summary\nCVE-2026-69192 is a critical parser differential vulnerability in the 'ip-address' JavaScript library (versions <= 10.3.0). The library parses IPv4 octets containing leading zeros as base-10 (decimal), whereas standard system resolvers and web environments parse them as base-8 (octal). This discrepancy allows remote attackers to bypass SSRF guards and route malicious requests to internal RFC 1918 networks.\n\n## TL;DR\nA parser discrepancy in 'ip-address' validates leading-zero IPv4 octets as decimal (e.g. '012' -> 12) while network stacks resolve them as octal (e.g. '012' -> 10). This differential allows unauthenticated attackers to bypass internal IP filters and execute Server-Side Request Forgery (SSRF).\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.7\n- **Exploit Status**: Proof of Concept\n- **Impact**: Server-Side Request Forgery\n- **Vulnerable Component**: Address4 Class\n- **Remediation Status**: Official Patch Released\n\n## Affected Systems\n\n- ip-address (npm package) versions <= 10.3.0\n- **ip-address**: < 10.3.1 (Fixed in: `10.3.1`)\n\n## Mitigation\n\n- Upgrade ip-address dependency to version 10.3.1 or higher.\n- Implement client-side pre-validation to reject IP addresses containing leading zeros in any octet.\n- Configure strict egress firewall rules to block application servers from reaching internal subnets.\n\n**Remediation Steps:**\n1. Execute 'npm install ip-address@latest' or 'yarn upgrade ip-address' to pull the patched version.\n2. Search the codebase for uses of Address4 or ip-address validation steps and ensure error handling is implemented for AddressError.\n3. Verify that fallback handlers do not route invalid inputs back to standard DNS resolution mechanisms.\n\n## References\n\n- [GHSA-mwp4-54f8-5fhr: Parser differential in ip-address](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr)\n- [Fix parser differential commit](https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e)\n- [Release v10.3.1](https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1)\n- [CVE-2026-69192 Record](https://www.cve.org/CVERecord?id=CVE-2026-69192)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69192) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T20:31:35.220762Z"}, {"uuid": "ecd1c851-32f9-43f2-a93f-118daaa6cad3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69192", "type": "published-proof-of-concept", "source": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr", "content": "", "creation_timestamp": "2026-08-03T20:35:03.594049Z"}, {"uuid": "c3e53086-77d9-470f-bfdd-77e5cdbccaf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69198", "type": "published-proof-of-concept", "source": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh", "content": "", "creation_timestamp": "2026-08-03T20:35:05.778480Z"}]}