AIKIDO-2026-381336

ip-address is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)GHSA-4xrf-jv44-h6hh Published 5 days ago

Medium Risk

This Affects:

ip-address

10.1.1 - 10.2.1

Fixed in 10.2.2

Are you affected? Scan for Free

TL;DR

Special-use classification in Address4 and Address6 is built on isInSubnet, which returns false whenever the parsed address carries a shorter subnet mask than the reference range. Appending a CIDR suffix such as /0 to a host string therefore suppresses classification, so isPrivate, isLoopback, isLinkLocal, and related checks report an internal address as unremarkable while the address still resolves to the real internal target. Applications that pass bare address strings that may include a suffix into SSRF or trust-boundary filters can be tricked into allowing requests to internal destinations. The fix adds host-only classification via isHostInSubnet so the address's own prefix no longer suppresses special-use detection.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and rely on the library's address classification methods to make trust-boundary or SSRF filtering decisions on address strings that may include a CIDR suffix.