CVE-2026-101912: ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ip-addressto a version that resolves this vulnerability.Fixed in 10.7.1
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using npm/ip-address versions earlier than 10.7.1 are affected if they use isInSubnet() or isHostInSubnet() to make allowlist or denylist decisions involving potentially mixed IPv4 and IPv6 inputs.
What conditions are required for an incorrect containment decision?
The containment check must compare addresses from different IP families, and their leading address bits must match such that the masked binary strings compare equal. An attacker would need to supply or cause evaluation of an address that meets those conditions.
How can teams determine whether their application is exposed?
Check whether the application depends on an ip-address release before 10.7.1 and identify uses of isInSubnet() or isHostInSubnet() in access-control, allowlist, or denylist logic. Exposure is relevant where those calls can receive an IPv4 address on one side and an IPv6 address on the other.
What should be done if an immediate upgrade is not possible?
Ensure both operands are validated as the same IP family before calling the containment methods, especially in authorization and filtering paths. Upgrade to version 10.7.1 when possible.