CVE-2026-101913Medium· 6.3▾ TwilightPoC availableip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.4%
Last analysed / modified upstream
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
ip-address <= 10.5.0Patched in:
ip-address 10.5.1Source: https://github.com/advisories/GHSA-rpw4-54j3-4h4q
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101910Medium· 6.9ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-101912Medium· 6.3ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-111997Medium· 5.3ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
CVE-2026-101911Medium· 6.3ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-42338Medium· 6.1ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-106445Critical· 9.2Handlebars provides the power necessary to let users build semantic templates