DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54272: CVE-2026-54272: SSRF and Trust-Boundary Bypass via Input Misclassification in ip-address Library

#security #cve #cybersecurity

CVE-2026-54272: SSRF and Trust-Boundary Bypass via Input Misclassification in ip-address Library

Vulnerability ID: CVE-2026-54272
CVSS Score: 6.9
Published: 2026-08-03

A trust-boundary bypass and Server-Side Request Forgery (SSRF) vulnerability exists in the ip-address library versions 10.1.1 through 10.2.0 due to structural input misclassification. The library fails to resolve and normalize transition IP notations, such as IPv4-mapped IPv6 (::ffff:0:0/96) and NAT64 (64:ff9b::/96) addresses, to their embedded IPv4 representations prior to evaluation. Consequently, standard security validation checks (e.g., isLoopback, isLinkLocal, isULA) return false for these addresses. This allows remote attackers to bypass application-level IP address filters, gaining unauthorized access to internal resources, cloud metadata interfaces, and local services on dual-stack hosts or environments utilizing NAT64 gateways.

TL;DR

Input misclassification in ip-address library <= 10.2.0 enables SSRF. The parser fails to normalize IPv4-mapped or NAT64 transition addresses before running boolean classification checks (e.g., isLoopback). This allows attackers to bypass security guards and connect to restricted internal IPv4 destinations over dual-stack host configurations.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918, CWE-20
  • Attack Vector: Network
  • CVSS v4.0 Score: 6.9 (Medium)
  • EPSS Score: 0.00254 (0.25%)
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • Applications incorporating npm package ip-address for IP validation
  • Dual-stack host configurations running vulnerable validation services
  • Environments utilizing NAT64/DNS64 translations with permissive HTTP proxies
  • ip-address: >= 10.1.1, <= 10.2.0 (Fixed in: 10.2.1)

Code Analysis

Commit: e86ab3e

Implement embeddedIPv4 delegation mapping and register ::ffff:0:0/96 in static TYPES lookup.

Commit: 4a1f613

Merge commit integrating the fix for GHSA-22jq-vg5j-6vgg.

Exploit Details

  • GitHub Security Advisory: Details the bypass capabilities and specific regression configurations for both IPv4-mapped and NAT64 patterns.

Mitigation Strategies

  • Upgrade dependency trees immediately to ip-address version 10.2.1 or newer.
  • Implement DNS lookup resolution first and validate the resolved IP addresses directly.
  • Deploy WAF rules to detect and drop transition IP notations at the perimeter.
  • Ensure HTTP clients establish connections directly to validated IP addresses rather than raw hostnames to prevent DNS Rebinding.

Remediation Steps:

  1. Update your project dependencies: run 'npm install ip-address@10.2.1' or verify nested occurrences via dependency locking tools.
  2. Refactor backend validation logic to check ip.isPrivate() and ip.isLoopback() on parsed instances.
  3. Ensure to address-pin HTTP client configurations using the resolved IP address while overriding the HTTP Host header.

References

Read the full report for CVE-2026-54272 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)