CVE-2026-101913: beaugunderson ip-address Incorrect Comparison
CVSS: 6.3v4.0MediumDeferred
AliasesUBUNTU-CVE-2026-101913DEBIAN-CVE-2026-101913CGA-289h-5mgc-p558CGA-477p-h2jf-9757CGA-4c3q-749w-fj7gCGA-6r3v-2px6-6672CGA-97x3-pwgq-5mrcCGA-cgg7-4p82-q8jvCGA-f9h2-hc5x-vg22CGA-g7v2-rffv-mc37CGA-gvmj-ww48-hxfvCGA-h56w-vxqw-5cq7CGA-h7gg-35jw-m2wvCGA-q8fg-w2x4-hgjwCGA-r685-4h62-58cqCGA-rv5v-jv74-m642CGA-vxvv-2jpr-3r83CGA-w8px-422h-pc87CGA-x538-g65v-26x2CGA-xcrr-j397-f3f7GHSA-rpw4-54j3-4h4qCGA-24rq-6xr3-2vh3CGA-2mg7-2xjp-99xjCGA-2ph4-7674-p63rCGA-2pww-hq3j-3px5CGA-2rxv-q828-jpg9CGA-2vvf-h657-9mw8CGA-336v-2w4x-vxg4CGA-3473-gvrg-cgfhCGA-3f28-9vg8-69qxCGA-3qgm-gfxp-vw6vCGA-45h3-vpr7-8j32CGA-467m-6q7g-6327CGA-47m3-jq9m-5qmmCGA-4r7f-386r-7fqfCGA-4rr9-65x9-q4h7CGA-5853-3vvx-88jpCGA-5fj6-8646-r75wCGA-5h3p-35pj-hx48CGA-5x65-j376-2h4pCGA-6q9g-cq8v-vgwmCGA-75hp-57f6-56hgCGA-7gr8-xghx-mm6fCGA-7r6q-xg5g-7qf9CGA-862m-hq48-jqq3CGA-8g5w-43r9-6jjrCGA-92fp-wqjj-jvcmCGA-92hm-vxqx-9hqhCGA-9388-rw6q-v524CGA-9c9m-c4jf-54j3CGA-9vwx-f65p-c6rwCGA-9w39-hjxp-9qh5CGA-9x7p-p7jp-6hc6CGA-cfhg-h5j4-2mvpCGA-g52g-9fph-v723CGA-gpjj-jwfq-4crrCGA-hc3q-mx82-vcp9CGA-hmxx-wx4q-x96vCGA-j78x-r22v-ff3fCGA-j9rp-9cv4-4mmcCGA-m647-8w45-64f8CGA-mpr6-x5w8-25wfCGA-p427-23r6-9c6xCGA-p5vw-mh2p-vw64CGA-pchq-mwgw-2m5cCGA-qrpw-f7mm-g8cwCGA-qvgf-8rg7-vq28CGA-rhx6-p3gv-p6gmCGA-rx52-f4cw-prrgCGA-rxg4-cp9m-rr88CGA-vg66-jx54-2398CGA-vgjq-vfcg-w287CGA-w39x-r94x-9765CGA-wh68-4c3r-cjhqCGA-x4q4-rxc2-px24CGA-xf5h-jw8h-6fq6CGA-xwjf-6c5r-w232CGA-439p-gg68-9cghCGA-rmcr-mfwp-m97r
Published 28-09-2026Last modified 28-09-2026
Vulnerability summary
CVE-2026-101913 is a medium (CVSS 6.3) Incorrect Comparison vulnerability in beaugunderson ip-address. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.2% of scored vulnerabilities.
CVSS score
6.3/10
010
Medium · v4.0 (CVE.org)EPSS score
0.39%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 28-09-2026PublishedVulnerability first disclosed.
- 28-09-2026Last modifiedVulnerability information updated.
Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 6.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
29-09-202620-10-2026
EPSS score0.39%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-697Incorrect ComparisonThe product compares two entities in a security-relevant context, but the comparison is incorrect.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Chainguard31 products
- actions-runner< 2.337.0-r2
- code-server< 4.139.1-r1
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
- commercial-gitlab-rails-ee-19.3< 19.3.3-r1
Wolfi8 products
- code-server< 4.139.1-r1
- lerna< 10.0.1-r5
- npm-12< 12.1.0-r1
- opensearch-dashboards-3All versions (No fix recorded) | < 3.9.0-r1
- prism< 5.16.0-r14
Beaugunderson1 product
- ip-address< 10.5.1
Debian1 product
- node-ip-addressAll versions (No fix recorded) | < 10.7.2-1
Npm1 product
- ip-address< 10.5.1
Ubuntu1 product
- node-ip-addressAll versions (No fix recorded)
6 vendors · 43 products
References
9 links- github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4qX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546X Refsource MISCREPORTFIXWEB
