AIKIDO-2026-154096

ip-address is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)GHSA-2vr4-cq9g-pvrc Published 2 days ago

Medium Risk

This Affects:

ip-address

10.2.1 - 10.5.0

Fixed in 10.5.1

Are you affected? Scan for Free

TL;DR

The Address6 special-use classifiers, including isPrivate(), isLoopback(), and isLinkLocal(), decide whether an IPv6 address is internal. They do not recognize the NAT64 local-use range 64:ff9b:1::/48 reserved by RFC 8215, so addresses in that range are reported as non-internal even though getType() labels them NAT64 (local-use). Internal IPv4 destinations encoded through a local-use NAT64 prefix are therefore misclassified as globally routable, and code that uses these classifiers for SSRF or trust-boundary filtering can be induced to reach an internal host. The fix reports the whole 64:ff9b:1::/48 range as private.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the Address6 special-use classifiers such as isPrivate() to make network trust-boundary decisions such as SSRF filtering.