AIKIDO-2026-496905
ip-address is vulnerable to Server-Side Request Forgery (SSRF)
77
High Risk
This Affects:
ip-addressTL;DR
Address4 accepts an IPv4 octet written with a leading zero and decodes it as decimal, while URL host parsers and system resolvers decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names, so an input like 012.0.0.1 is reported as public and non-private even though a request to it reaches 10.0.0.1. Applications that build SSRF or trust-boundary filters on classifiers such as isPrivate and isInSubnet can be tricked into treating an internal target as external and allowing the request. The fix rejects any octet that has a leading zero followed by further digits in Address4.parse and tightens the address regex so those forms are no longer valid.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and rely on the library's address classification methods to make network trust-boundary or SSRF filtering decisions.
Background info
ip-address is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 10.3.0.
How to fix this
Upgrade the ip-address library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant