AIKIDO-2026-604326

ip-address is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)GHSA-rpw4-54j3-4h4q Published 2 days ago

Medium Risk

This Affects:

ip-address

0.0.1 - 10.5.0

Fixed in 10.5.1

Are you affected? Scan for Free

TL;DR

The Address6 class exposes isLinkLocal() to decide whether an IPv6 address is a link-local unicast address. The method compares the first 64 bits of the address against fe80:0000:0000:0000 instead of testing the fe80::/10 prefix defined by RFC 4291, so only addresses inside fe80::/64 are recognized. Link-local addresses such as fe81::1 or febf::1 are reported as non-link-local, and code that builds an SSRF or trust-boundary filter on this check can be induced to treat an on-link host as external. The fix tests membership in the full fe80::/10 subnet.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the Address6 special-use classifiers such as isLinkLocal() to make network trust-boundary decisions such as SSRF filtering.