These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The ip-address library for JavaScript, versions 10.1.1 to 10.2.1, contains a vulnerability where special-use classification methods may incorrectly classify internal addresses as unremarkable due to a mask comparison issue. This could lead to incorrect trust-boundary decisions, potentially allowing Server-Side Request Forgery (SSRF) attacks. The issue is fixed in version 10.2.2.
The ip-address library for JavaScript, prior to version 10.3.1, incorrectly decodes IPv4 addresses with leading zeros in octets, diverging from standard network parsers. This discrepancy can lead to incorrect classification of internal network addresses as external, potentially allowing unauthorized access in Server-Side Request Forgery (SSRF) scenarios. The issue affects various address checking function [truncated]
CVE-2026-54272 is a Server-Side Request Forgery (SSRF) vulnerability in the ip-address library for JavaScript, affecting versions 10.1.1 through 10.2.0. The vulnerability arises from the misclassification of IPv4-mapped/NAT64 IPv6 addresses. The Address6.getType() method classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. [truncated]