{"vulnerability": "ghsa-mwp4-54f8-5fhr", "sightings": [{"uuid": "4d89a3ff-873f-4678-a7ad-7c7da881b29f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-mwp4-54f8-5fhr", "type": "seen", "source": "https://gist.github.com/alon710/572dbe4f17925376407c061da3100fba", "content": "# CVE-2026-69192: CVE-2026-69192: SSRF Bypass via Parser Differential (Octal vs Decimal) in ip-address JavaScript Library\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69192\n\n## Summary\nCVE-2026-69192 is a critical parser differential vulnerability in the 'ip-address' JavaScript library (versions <= 10.3.0). The library parses IPv4 octets containing leading zeros as base-10 (decimal), whereas standard system resolvers and web environments parse them as base-8 (octal). This discrepancy allows remote attackers to bypass SSRF guards and route malicious requests to internal RFC 1918 networks.\n\n## TL;DR\nA parser discrepancy in 'ip-address' validates leading-zero IPv4 octets as decimal (e.g. '012' -> 12) while network stacks resolve them as octal (e.g. '012' -> 10). This differential allows unauthenticated attackers to bypass internal IP filters and execute Server-Side Request Forgery (SSRF).\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.7\n- **Exploit Status**: Proof of Concept\n- **Impact**: Server-Side Request Forgery\n- **Vulnerable Component**: Address4 Class\n- **Remediation Status**: Official Patch Released\n\n## Affected Systems\n\n- ip-address (npm package) versions <= 10.3.0\n- **ip-address**: < 10.3.1 (Fixed in: `10.3.1`)\n\n## Mitigation\n\n- Upgrade ip-address dependency to version 10.3.1 or higher.\n- Implement client-side pre-validation to reject IP addresses containing leading zeros in any octet.\n- Configure strict egress firewall rules to block application servers from reaching internal subnets.\n\n**Remediation Steps:**\n1. Execute 'npm install ip-address@latest' or 'yarn upgrade ip-address' to pull the patched version.\n2. Search the codebase for uses of Address4 or ip-address validation steps and ensure error handling is implemented for AddressError.\n3. Verify that fallback handlers do not route invalid inputs back to standard DNS resolution mechanisms.\n\n## References\n\n- [GHSA-mwp4-54f8-5fhr: Parser differential in ip-address](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr)\n- [Fix parser differential commit](https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e)\n- [Release v10.3.1](https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1)\n- [CVE-2026-69192 Record](https://www.cve.org/CVERecord?id=CVE-2026-69192)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69192) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T20:31:35.272392Z"}]}