CVE-2026-69198

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing (CIDR) suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such as those designed to prevent Server-Side Request Forgery (SSRF), to incorrectly treat internal network targets as external. Consequently, an attacker may be able to access internal resources or bypass other network trust-boundary checks.

Red Hat products that ship the affected ip-address library versions use it in browser-side UI components for IP address display and form validation, not for server-side request filtering or SSRF protection. The classification bypass has no security-relevant effect in this context because no trust-boundary decisions are built on these client-side checks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Validate and sanitize CIDR suffixes on IP address input before passing them to the ip-address library. Reject any user-supplied address where the prefix length is outside the valid range for the address family (0-32 for IPv4, 0-128 for IPv6) or where the prefix length contradicts the intended classification check. Applications that rely on ip-address for SSRF filtering should add an independent server-side check that does not depend on the library's classification methods.