AIKIDO-2026-340318
ip-address is vulnerable to Improper Access Control
63
Medium Risk
This Affects:
ip-addressTL;DR
isInSubnet() and isHostInSubnet() compare an address's masked bits against another address's mask without first checking that both addresses belong to the same family, so a 32-bit IPv4 bit pattern can coincide with the leading bits of a 128-bit IPv6 address and be reported as contained in that subnet. Code that calls either method for a trust-boundary decision, such as an SSRF allow or deny list, can be misled into treating an address from the wrong family as inside an expected network. The fix returns false whenever the two addresses being compared have different bit widths.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use isInSubnet() or isHostInSubnet() to decide whether an address belongs to an allowed or blocked network.
Background info
ip-address is vulnerable to Improper Access Control in versions 3.2.1 - 10.7.0.
How to fix this
Upgrade the ip-address library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.