CVE-2026-69192

CVE Details

Release Date:	2026-08-03
Impact:	Important	What is this?

Description

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

See more information about CVE-2026-69192 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	8.6
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Changed
Confidentiality Impact:	High
Integrity Impact:	None
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (nodejs)	ELSA-2026-54371	2026-08-14
Oracle Linux version 8 (nodejs)	ELSA-2026-54530	2026-08-14
Oracle Linux version 8 (nodejs-nodemon)	ELSA-2026-54371	2026-08-14
Oracle Linux version 8 (nodejs-nodemon)	ELSA-2026-54530	2026-08-14
Oracle Linux version 8 (nodejs-packaging)	ELSA-2026-54371	2026-08-14
Oracle Linux version 8 (nodejs-packaging)	ELSA-2026-54530	2026-08-14