CVE-2026-69192 beaugunderson CVE debrief

Who should care

Defenders responsible for network security, particularly those managing systems that rely on accurate IP address classification for security decisions, should assess exposure and prioritize updating the ip-address library.

Why it matters

The ip-address library vulnerability can lead to incorrect security decisions, potentially allowing unauthorized access. Defenders should prioritize updating to version 10.3.1 or later and assess exposure in systems relying on accurate IP address classification.

• Incorrect classification of internal network addresses as external
• Potential bypass of Server-Side Request Forgery (SSRF) protections
• Inaccurate trust-boundary decisions based on IP address classification
• Verification of IP address classification in network security controls

Technical summary

The ip-address library for JavaScript incorrectly decodes IPv4 addresses with leading zeros in octets, diverging from standard network parsers like WHATWG URL host parser, inet_aton, and getaddrinfo. This discrepancy affects various address checking functions, including isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm(). The issue is fixed in version 10.3.1.

Defensive priority

Defenders should prioritize updating the ip-address library to version 10.3.1 or later to mitigate this vulnerability. Systems using affected versions should assess exposure, particularly those relying on accurate IP address classification for security decisions.

Recommended defensive actions

• Update the ip-address library to version 10.3.1 or later
• Assess exposure in systems relying on accurate IP address classification
• Verify IP address classification in network trust-boundary decisions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the ip-address library vulnerability. The issue is fixed in version 10.3.1. Official references include GitHub commits and release notes. Affected systems using versions prior to 10.3.1 may misclassify internal network addresses, potentially allowing unauthorized access. Defenders should verify IP address classification in network security controls and assess exposure, particularly in systems relying on accurate IP address classification for security decisions. The ip-address library's

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.