CVE-2026-101913

The record

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.

Affected packages

Related vulnerabilities

• CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-697
• CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control… CWE-697
• CVE-2026-56101 OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the… CWE-697
• CVE-2026-73309 XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token… CWE-697
• CVE-2026-80227 Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string… CWE-697
• CVE-2026-18664 When ranges are used for access control (i.e. CWE-697
• CVE-2026-20765 Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within… CWE-697