{"vulnerability": "ghsa-4xrf-jv44-h6hh", "sightings": [{"uuid": "980a8c7d-7ee4-427b-a760-334ecf87f8d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-4xrf-jv44-h6hh", "type": "seen", "source": "https://gist.github.com/alon710/7d8f1377f69b3f931098d4cd17c3c6cd", "content": "# CVE-2026-69198: CVE-2026-69198: Server-Side Request Forgery Bypass via CIDR Suffix in ip-address Library\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69198\n\n## Summary\nAn input validation vulnerability in the npm package `ip-address` allows unauthenticated remote attackers to bypass Server-Side Request Forgery (SSRF) protections by appending a `/0` CIDR suffix to IP address strings. This causes the library's classification helper functions to incorrectly identify internal addresses as public, external addresses, while normalization helpers resolve the address back to its internal form during network connection establishment.\n\n## TL;DR\nA design flaw in the `ip-address` library's classification logic allows attackers to bypass SSRF filters. Adding a `/0` suffix short-circuits internal checks, making local/private IPs look public.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20, CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.9 (Medium)\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not Listed\n- **Impact**: Server-Side Request Forgery Bypass\n\n## Affected Systems\n\n- Node.js applications using `ip-address` version >= 10.1.1 and < 10.2.2 for input validation and SSRF defenses\n- **ip-address**: >= 10.1.1, < 10.2.2 (Fixed in: `10.2.2`)\n\n## Mitigation\n\n- Upgrade ip-address library to 10.2.2 or higher.\n- Sanitize user input to strip CIDR suffixes before passing to parsing libraries.\n- Use network-level firewalls to enforce SSRF egress blocks independent of application code.\n\n**Remediation Steps:**\n1. Identify all applications utilizing the `ip-address` npm package.\n2. Update `package.json` to reference version `^10.2.2`.\n3. Execute `npm install` or `yarn install` to apply the update.\n4. Validate that IP classification functions reject loopback and private blocks even with trailing suffixes.\n\n## References\n\n- [GitHub Security Advisory GHSA-4xrf-jv44-h6hh](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh)\n- [Fix Commit 488fe9bc7c35363b4b090494fc38c266d217740d](https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d)\n- [GitHub Release v10.2.2](https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69198) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T09:31:38.498258Z"}]}