CVE-2026-69198: CVE-2026-69198: Server-Side Request Forgery Bypass via CIDR Suffix in ip-address Library

CVE-2026-69198: Server-Side Request Forgery Bypass via CIDR Suffix in ip-address Library

Vulnerability ID: CVE-2026-69198
CVSS Score: 6.9
Published: 2026-08-03

An input validation vulnerability in the npm package ip-address allows unauthenticated remote attackers to bypass Server-Side Request Forgery (SSRF) protections by appending a /0 CIDR suffix to IP address strings. This causes the library's classification helper functions to incorrectly identify internal addresses as public, external addresses, while normalization helpers resolve the address back to its internal form during network connection establishment.

TL;DR

A design flaw in the ip-address library's classification logic allows attackers to bypass SSRF filters. Adding a /0 suffix short-circuits internal checks, making local/private IPs look public.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-20, CWE-918
• Attack Vector: Network (AV:N)
• CVSS Score: 6.9 (Medium)
• Exploit Status: Proof of Concept available
• KEV Status: Not Listed
• Impact: Server-Side Request Forgery Bypass

Affected Systems

• Node.js applications using ip-address version >= 10.1.1 and < 10.2.2 for input validation and SSRF defenses
• ip-address: >= 10.1.1, < 10.2.2 (Fixed in: 10.2.2)

Code Analysis

Commit: 488fe9b

Separate network containment checks from host address classification by introducing isHostInSubnet and updating classification helpers.

@@ -11,5 +11,11 @@
-export function isInSubnet(this: Address4 | Address6, address: Address4 | Address6) {
-  if (this.subnetMask < address.subnetMask) {
-    return false;
-  }
-
-  if (this.mask(address.subnetMask) === address.mask()) {
-    return true;
-  }
-
-  return false;
-}
+export function isInSubnet(this: Address4 | Address6, address: Address4 | Address6) {
+  if (this.subnetMask < address.subnetMask) {
+    return false;
+  }
+
+  return isHostInSubnet.call(this, address);
+}
+
+export function isHostInSubnet(this: Address4 | Address6, address: Address4 | Address6) {
+  return this.mask(address.subnetMask) === address.mask();
+}

Mitigation Strategies

• Upgrade ip-address library to 10.2.2 or higher.
• Sanitize user input to strip CIDR suffixes before passing to parsing libraries.
• Use network-level firewalls to enforce SSRF egress blocks independent of application code.

Remediation Steps:

1. Identify all applications utilizing the ip-address npm package.
2. Update package.json to reference version ^10.2.2.
3. Execute npm install or yarn install to apply the update.
4. Validate that IP classification functions reject loopback and private blocks even with trailing suffixes.

References

• GitHub Security Advisory GHSA-4xrf-jv44-h6hh
• Fix Commit 488fe9bc7c35363b4b090494fc38c266d217740d
• GitHub Release v10.2.2

---

Read the full report for CVE-2026-69198 on our website for more details including interactive diagrams and full exploit analysis.