CVE-2026-101912 ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
Attackers can bypass IP allowlists by exploiting a logic error that incorrectly matches IPv4 and IPv6 addresses, admitting unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-101912?
CVE-2026-101912 is a medium-severity vulnerability in beaugunderson ip-address, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.
Which versions are affected by CVE-2026-101912?
2 open source packages ship an affected version, including ip-address.
| Package | Affected | Fixed in |
|---|---|---|
ip-address npm | All versions | 10.7.1 |
ip-address npm | All versions | 10.7.1 |
How do I fix CVE-2026-101912?
Upgrade ip-address to 10.7.1 or later.
Is CVE-2026-101912 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-101912 exists.
Sources
Also known as CLEANSTART-2026-EF09079, CLEANSTART-2026-FH34205, CLEANSTART-2026-XD91859, CLEANSTART-2026-XK88053, CLSA-2026-1790854765, CLSA-2026-1790864845 and 36 more.