ip-address (npm)
💻 a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
Advisories
20
Latest version
10.7.5
Released Oct 25, 2026
License
MIT
OpenSSF Scorecard
6.9 / 10
How to fix
Upgrading to 10.7.4 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install ip-address@10.7.5yarn
yarn add ip-address@10.7.5pnpm
pnpm add ip-address@10.7.5Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-p3hm-x653-5rc6 Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process Withdrawn |
Medium | <= 10.7.3 | No fix yet |
| GHSA-p3hm-x653-5rc6 Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process Withdrawn |
Medium | <= 10.7.3 | No fix yet |
| GHSA-rxp7-6hxx-x8q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process |
Medium EPSS 0.32% |
< 10.7.4 | 10.7.4 |
| GHSA-rxp7-6hxx-x8q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process |
Medium EPSS 0.32% |
<= 10.7.3 | No fix yet |
| GHSA-rpw4-54j3-4h4q ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts |
Medium EPSS 0.39% |
< 10.5.1 | 10.5.1 |
| GHSA-rpw4-54j3-4h4q ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts |
Medium EPSS 0.39% |
<= 10.5.0 | No fix yet |
| GHSA-j6r3-76f7-8jcv ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range |
Medium EPSS 0.37% |
< 10.7.1 | 10.7.1 |
| GHSA-j6r3-76f7-8jcv ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range |
Medium EPSS 0.37% |
<= 10.7.0 | No fix yet |
| GHSA-h3mg-xc3c-68pw ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process |
Medium EPSS 0.38% |
<= 10.7.0 | No fix yet |
| GHSA-h3mg-xc3c-68pw ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process |
Medium EPSS 0.38% |
< 10.7.1 | 10.7.1 |
| GHSA-2vr4-cq9g-pvrc ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass |
Medium EPSS 0.39% |
>= 10.2.0, < 10.5.1 | 10.5.1 |
| GHSA-2vr4-cq9g-pvrc ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass |
Medium EPSS 0.39% |
>= 10.2.0, <= 10.5.0 | No fix yet |
| GHSA-mwp4-54f8-5fhr ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass |
High EPSS 0.46% |
< 10.3.1 | 10.3.1 |
| GHSA-mwp4-54f8-5fhr ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass |
High EPSS 0.46% |
<= 10.3.0 | No fix yet |
| GHSA-4xrf-jv44-h6hh ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks |
Medium EPSS 0.48% |
>= 10.1.1, < 10.2.2 | 10.2.2 |
| GHSA-4xrf-jv44-h6hh ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks |
Medium EPSS 0.48% |
>= 10.1.1, <= 10.2.1 | No fix yet |
| GHSA-22jq-vg5j-6vgg ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks |
Medium EPSS 0.40% |
>= 10.1.1, < 10.2.1 | 10.2.1 |
| GHSA-22jq-vg5j-6vgg ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks |
Medium EPSS 0.40% |
>= 10.1.1, <= 10.2.0 | No fix yet |
| GHSA-v2v4-37r5-5v8g ip-address has XSS in Address6 HTML-emitting methods |
Medium EPSS 0.47% |
< 10.1.1 | 10.1.1 |
| GHSA-v2v4-37r5-5v8g ip-address has XSS in Address6 HTML-emitting methods |
Medium EPSS 0.47% |
<= 10.1.0 | No fix yet |
Source: git+https://github.com/beaugunderson/ip-address.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor