PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54272 beaugunderson CVE debrief

CVE-2026-54272 is a Server-Side Request Forgery (SSRF) vulnerability in the ip-address library for JavaScript, affecting versions 10.1.1 through 10.2.0. The vulnerability arises from the misclassification of IPv4-mapped/NAT64 IPv6 addresses. The Address6.getType() method classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. However, the table lacked an entry for the IPv4-mapped range (::ffff:0:0/96), causing every mapped address to fall through to Global unicast. Additionally, NAT64 addresses matched their own NAT64 labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library exposed isMapped4() and to4() but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses, the host OS routes to the IPv4 stack, making the misclassification reachable on any dual-stack host. For NAT64, the classification bypass is unconditional, but end-to-end reachability requires a NAT64/DNS64 gateway in the deployment network. This issue has been fixed in version 10.2.1.

Vendor
beaugunderson
Product
ip-address
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-07-27
Advisory published
2026-07-27
Advisory updated
2026-07-27

Who should care

Developers and administrators using the ip-address library in JavaScript applications, especially those handling IPv4 and IPv6 addresses, should be aware of this vulnerability. The misclassification of IPv4-mapped/NAT64 IPv6 addresses can lead to Server-Side Request Forgery (SSRF) attacks, which can be particularly problematic in dual-stack hosts or networks with NAT64/DNS64 gateways.

Technical summary

The ip-address library for JavaScript, versions 10.1.1 through 10.2.0, is vulnerable to Server-Side Request Forgery (SSRF) due to the incorrect classification of IPv4-mapped and NAT64 IPv6 addresses. The Address6.getType() method does not properly handle these address types, leading to potential SSRF attacks. This vulnerability has been addressed in version 10.2.1. Affected product deployments should be reviewed for exposure, and owners should plan for vendor-supported updates or mitigations. Compensating controls should be considered for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium

Recommended defensive actions

  • Update the ip-address library to version 10.2.1 or later
  • Review and validate IP address classification in applications using the ip-address library
  • Implement additional security measures to detect and prevent SSRF attacks
  • Monitor for suspicious activity related to IP address handling
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-27T18:16:56.410Z and has not been modified since then. The NVD entry is currently 6.9 MEDIUM. Limited information is available about the specific impact and affected systems.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T18:16:56.410Z and has not been modified since then.