DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-69192: CVE-2026-69192: SSRF Bypass via Parser Differential (Octal vs Decimal) in ip-address JavaScript Library

#security #cve #cybersecurity

CVE-2026-69192: SSRF Bypass via Parser Differential (Octal vs Decimal) in ip-address JavaScript Library

Vulnerability ID: CVE-2026-69192
CVSS Score: 7.7
Published: 2026-08-03

CVE-2026-69192 is a critical parser differential vulnerability in the 'ip-address' JavaScript library (versions <= 10.3.0). The library parses IPv4 octets containing leading zeros as base-10 (decimal), whereas standard system resolvers and web environments parse them as base-8 (octal). This discrepancy allows remote attackers to bypass SSRF guards and route malicious requests to internal RFC 1918 networks.

TL;DR

A parser discrepancy in 'ip-address' validates leading-zero IPv4 octets as decimal (e.g. '012' -> 12) while network stacks resolve them as octal (e.g. '012' -> 10). This differential allows unauthenticated attackers to bypass internal IP filters and execute Server-Side Request Forgery (SSRF).

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS v4.0 Score: 7.7
  • Exploit Status: Proof of Concept
  • Impact: Server-Side Request Forgery
  • Vulnerable Component: Address4 Class
  • Remediation Status: Official Patch Released

Affected Systems

  • ip-address (npm package) versions <= 10.3.0
  • ip-address: < 10.3.1 (Fixed in: 10.3.1)

Code Analysis

Commit: 56368cb

Fix parser differential vulnerability by disallowing leading zeros in IPv4 octets and checking for multiple subnet slashes.

Exploit Details

Mitigation Strategies

  • Upgrade ip-address dependency to version 10.3.1 or higher.
  • Implement client-side pre-validation to reject IP addresses containing leading zeros in any octet.
  • Configure strict egress firewall rules to block application servers from reaching internal subnets.

Remediation Steps:

  1. Execute 'npm install ip-address@latest' or 'yarn upgrade ip-address' to pull the patched version.
  2. Search the codebase for uses of Address4 or ip-address validation steps and ensure error handling is implemented for AddressError.
  3. Verify that fallback handlers do not route invalid inputs back to standard DNS resolution mechanisms.

References

Read the full report for CVE-2026-69192 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)