AIKIDO-2026-391751

ip-address is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)CVE-2026-54272 Published 6 days ago

Medium Risk

This Affects:

ip-address

10.1.1 - 10.2.0

Fixed in 10.2.1

Are you affected? Scan for Free

TL;DR

Address6 classifies IPv4-mapped (::ffff:0:0/96) and NAT64 well-known (64:ff9b::/96) addresses by their IPv6 wrapper rather than the IPv4 address they embed, and it lacks an isPrivate method. Checks such as isLoopback, isLinkLocal, isMulticast, and isUnspecified therefore return false for literals like ::ffff:127.0.0.1 or ::ffff:169.254.169.254 that actually route to loopback, RFC 1918, or link-local destinations. Applications that build SSRF or trust-boundary filters on these classifiers can be tricked into allowing requests to internal targets. The fix normalizes IPv4-mapped and NAT64 addresses to their embedded IPv4 address before classification and adds the missing special-use checks.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and rely on the library's address classification methods to make network trust-boundary or SSRF filtering decisions.