CVE-2026-54272

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassification to bypass network restrictions and potentially access or manipulate internal resources. This vulnerability can be exploited on any dual-stack host for IPv4-mapped addresses, and for NAT64, it requires a NAT64/DNS64 gateway in the deployment network.

This is a Moderate flaw where the ip-address JavaScript library incorrectly classifies IPv4-mapped or NAT64 IPv6 addresses. This misclassification can lead to Server-Side Request Forgery (SSRF), allowing an attacker to bypass intended network restrictions and access internal resources. Exploitation is possible on dual-stack hosts for IPv4-mapped addresses, while NAT64 exploitation requires a NAT64/DNS64 gateway.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.