ip-address 5.9.2

Direct Vulnerabilities

Known vulnerabilities in the ip-address package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Allocation of Resources Without Limits or Throttling ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `Address6.isValid()` method (and the `Address4` constructor) when parsing an oversized input string. The bad-character diagnostic wraps every offending character in an HTML `<span>` element, so an N-byte string of punctuation produces approximately 106N bytes of output and triggers a synchronous `String.replace` over the entire result. An 8 MiB input takes roughly 529 ms and 895 MB of memory, a 16 MiB input causes a `RangeError` by exceeding V8's maximum string length, and a 32 MiB input causes V8 to abort the process entirely with a fatal invalid-size error. Note: Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to `Address6` or `Address4` parsing without an earlier length bound. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `ip-address` to version 10.7.1 or higher.	<10.7.1
M Incorrect Behavior Order ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Incorrect Behavior Order via the `isLinkLocal()` method, which incorrectly compared only the first 64 bits of an IPv6 address against the fixed pattern `fe80:0:0:0`, effectively recognising only `fe80::/64` as link-local. Addresses within the full `fe80::/10` range defined by RFC 4291 §2.4 - such as `fe81::1`, `febf::1`, or `fe80:0:0:1::1` - are incorrectly classified as non-link-local, causing the library to disagree with itself because `getType()` and `getScope()` already matched the correct `/10` subnet. An attacker can exploit this inconsistency to bypass link-local address checks in applications that rely on `isLinkLocal()` for access control or routing decisions. How to fix Incorrect Behavior Order? Upgrade `ip-address` to version 10.5.1 or higher.	<10.5.1
M Improper Validation of Specified Type of Input ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via `isHostInSubnet()` (and `isInSubnet()` which delegates to it), which compares masked binary strings without first verifying that both addresses belong to the same address family. Because `Address4` pads its binary representation to 32 bits and `Address6` pads to 128 bits, leading bit sequences can coincide across families, causing an IPv6 address to be incorrectly reported as contained within an IPv4 subnet and vice versa (for example, `a00::1` is evaluated as inside `10.0.0.0/8`). An attacker who controls an IP address value passed to a subnet membership check can bypass trust-boundary decisions such as SSRF allow/deny filters by supplying an address of the opposite family. How to fix Improper Validation of Specified Type of Input? Upgrade `ip-address` to version 10.7.1 or higher.	<10.7.1
M Server-side Request Forgery (SSRF) ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through improper handling of IPv4 addresses with leading zeros in the `Address4`. An attacker can bypass network trust-boundary checks by submitting specially crafted IP addresses that are interpreted differently by the library and the underlying network resolver, potentially allowing unauthorized access to internal resources. How to fix Server-side Request Forgery (SSRF)? Upgrade `ip-address` to version 10.3.1 or higher.	<10.3.1
M Cross-site Scripting (XSS) ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the `group`, `link`, and `spanAll` functions, as well as the `parseMessage` field of thrown errors. An attacker can execute arbitrary JavaScript in the context of the application by supplying crafted input that is rendered as HTML. This is only exploitable if untrusted input is passed to the relevant functions and their output is rendered as HTML (e.g., via innerHTML). How to fix Cross-site Scripting (XSS)? Upgrade `ip-address` to version 10.1.1 or higher.	<10.1.1

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid() method (and the Address4 constructor) when parsing an oversized input string. The bad-character diagnostic wraps every offending character in an HTML <span> element, so an N-byte string of punctuation produces approximately 106N bytes of output and triggers a synchronous String.replace over the entire result. An 8 MiB input takes roughly 529 ms and 895 MB of memory, a 16 MiB input causes a RangeError by exceeding V8's maximum string length, and a 32 MiB input causes V8 to abort the process entirely with a fatal invalid-size error.

Note: Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 or Address4 parsing without an earlier length bound.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade ip-address to version 10.7.1 or higher.

<10.7.1

Incorrect Behavior Order

ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser.

Affected versions of this package are vulnerable to Incorrect Behavior Order via the isLinkLocal() method, which incorrectly compared only the first 64 bits of an IPv6 address against the fixed pattern fe80:0:0:0, effectively recognising only fe80::/64 as link-local. Addresses within the full fe80::/10 range defined by RFC 4291 §2.4 - such as fe81::1, febf::1, or fe80:0:0:1::1 - are incorrectly classified as non-link-local, causing the library to disagree with itself because getType() and getScope() already matched the correct /10 subnet. An attacker can exploit this inconsistency to bypass link-local address checks in applications that rely on isLinkLocal() for access control or routing decisions.

How to fix Incorrect Behavior Order?

Upgrade ip-address to version 10.5.1 or higher.

<10.5.1

Improper Validation of Specified Type of Input

ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via isHostInSubnet() (and isInSubnet() which delegates to it), which compares masked binary strings without first verifying that both addresses belong to the same address family. Because Address4 pads its binary representation to 32 bits and Address6 pads to 128 bits, leading bit sequences can coincide across families, causing an IPv6 address to be incorrectly reported as contained within an IPv4 subnet and vice versa (for example, a00::1 is evaluated as inside 10.0.0.0/8). An attacker who controls an IP address value passed to a subnet membership check can bypass trust-boundary decisions such as SSRF allow/deny filters by supplying an address of the opposite family.

How to fix Improper Validation of Specified Type of Input?

Upgrade ip-address to version 10.7.1 or higher.

<10.7.1

Server-side Request Forgery (SSRF)

ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through improper handling of IPv4 addresses with leading zeros in the Address4. An attacker can bypass network trust-boundary checks by submitting specially crafted IP addresses that are interpreted differently by the library and the underlying network resolver, potentially allowing unauthorized access to internal resources.

How to fix Server-side Request Forgery (SSRF)?

Upgrade ip-address to version 10.3.1 or higher.

<10.3.1

Cross-site Scripting (XSS)

ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the group, link, and spanAll functions, as well as the parseMessage field of thrown errors. An attacker can execute arbitrary JavaScript in the context of the application by supplying crafted input that is rendered as HTML. This is only exploitable if untrusted input is passed to the relevant functions and their output is rendered as HTML (e.g., via innerHTML).

How to fix Cross-site Scripting (XSS)?

Upgrade ip-address to version 10.1.1 or higher.

<10.1.1

ip-address@5.9.2

A library for parsing IPv4 and IPv6 IP addresses in node and the browser.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically