CVE-2026-69198: 
JavaScript vulnerability analysis and mitigation

CVE-2026-69198 is a logic flaw in the ip-address npm library (by beaugunderson) that allows CIDR suffix manipulation to bypass special-use address classification, enabling Server-Side Request Forgery (SSRF) filter evasion. The vulnerability affects versions >= 10.1.1 and <= 10.2.1 of the ip-address package; versions before 10.1.1 are not affected as the classification API did not exist. It was reported by researcher @hi-im-glitchless, published to the GitHub Advisory Database on August 3, 2026, and assigned GHSA-4xrf-jv44-h6hh. The CVSS v4.0 base score is 6.9 (Medium) (Github Advisory).

The root cause (CWE-20: Improper Input Validation; CWE-918: SSRF) lies in the isInSubnet() function in src/common.ts, which opens with a guard that short-circuits to false when the receiver's subnet mask is shorter than the reference range's mask. Because all special-use classifiers (isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), getType()) delegate to isInSubnet(), appending a CIDR suffix such as /0 to an internal address causes the guard to fire before any bit comparison, returning false and misreporting the address as non-internal. Critically, correctForm() and the underlying address bits are unaffected, so the server still connects to the real internal target. The fix introduces a new isHostInSubnet() function that compares host bits against the reference range independently of the caller-supplied prefix, and all classifiers were updated to use it (Github Advisory, Fix Commit).

Successful exploitation allows an attacker to bypass SSRF filters and trust-boundary checks built on the affected classification methods, causing the server to make requests to internal destinations such as loopback services (127.0.0.1), RFC 1918 private ranges, link-local cloud metadata endpoints (e.g., 169.254.169.254 — AWS/GCP IMDS), CGNAT ranges, and IPv6 equivalents including ULA and IPv4-mapped addresses. The primary impact is high confidentiality loss on subsequent systems (e.g., cloud metadata credential theft, internal service enumeration), with no direct integrity or availability impact on the vulnerable system itself. This vulnerability also nullifies the prior fix for GHSA-22jq-vg5j-6vgg, meaning IPv4-mapped (::ffff:127.0.0.1/0) and NAT64 (64:ff9b::7f00:1/0) bypass paths are also re-opened (Github Advisory).

A proof-of-concept is publicly available in the GitHub Security Advisory and demonstrates that any suffixed internal address (e.g., 127.0.0.1/0, 169.254.169.254/0, ::1/0) is allowed through an affected SSRF filter. The NVD SSVC assessment classifies exploitation as "poc" with non-automatable technical impact. The EPSS score is approximately 0.276%, indicating a low but non-negligible probability of exploitation in the next 30 days. There is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (Github Advisory).

1. Identify a vulnerable application: Find a Node.js application using ip-address versions >= 10.1.1 and <= 10.2.1 that accepts a bare IP address string (not extracted from a URL) as input for a webhook target, proxy destination, or allow/deny field, and uses the library's classification methods as an SSRF guard.
2. Craft a suffixed internal address: Append a CIDR suffix shorter than the target range's prefix to an internal address. For universal bypass, use /0 (e.g., 127.0.0.1/0, 169.254.169.254/0, ::1/0, ::ffff:127.0.0.1/0). For partial bypass, use a suffix shorter than the specific range (e.g., 10.0.0.5/7 bypasses isPrivate() for the 10.0.0.0/8 range).
3. Submit the crafted input: Provide the suffixed address string to the application's input field (e.g., a webhook URL host field, proxy target, or API parameter that accepts raw address strings).
4. Bypass the SSRF filter: The application passes the string to new Address4(input) or new Address6(input) and calls classification methods. Due to the bug, all classifiers return false, and the filter allows the request.
5. Reach the internal target: The application uses correctForm() or the address object to make the outbound request, which resolves to the real internal address (e.g., the cloud metadata endpoint at 169.254.169.254), allowing the attacker to retrieve sensitive data such as IAM credentials (Github Advisory).

• Network: Outbound server-initiated HTTP requests to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 100.64.0.0/10) or cloud metadata endpoints (169.254.169.254) originating from the application server process.
• Logs: Application access logs showing user-supplied input fields containing IP addresses with CIDR suffixes (e.g., patterns matching \d+\.\d+\.\d+\.\d+/\d+ or [0-9a-fA-F:]+/\d+) in webhook, proxy, or destination parameters; server-side HTTP client logs showing requests to internal RFC 1918 or loopback addresses.
• Application Behavior: Unexpected responses from internal services (e.g., cloud metadata JSON, internal API responses) returned to external users or logged in application output.

Upgrade the ip-address npm package to version 10.2.2, which introduces isHostInSubnet() and updates all classifiers to use it, making classification independent of the caller-supplied CIDR suffix (v10.2.2 Release). If immediate upgrade is not possible, strip the CIDR suffix before classifying by re-parsing via addressMinusSuffix: const host = new Address4(new Address4(userInput).addressMinusSuffix); and classify host instead. Additionally, the advisory notes that these classification methods should be treated as one layer of SSRF defense — a robust guard must also resolve hostnames and validate the resolved IP at connection time to account for DNS rebinding and redirects (Github Advisory). IBM DevOps Solution Workbench users should consult the IBM security bulletin for affected product versions (IBM Advisory).

Red Hat tracked the vulnerability via Bugzilla (Bug #2510803) and issued an errata (RHSA-2026:50826), indicating downstream impact on Red Hat products consuming the ip-address library (Red Hat Errata). IBM published a security bulletin noting that IBM DevOps Solution Workbench is affected (IBM Advisory). The Twenty CRM project released v2.28.0 addressing this dependency. No significant broader social media or researcher commentary beyond the advisory itself has been observed.