Skip to main content

ip-address npm package CVE-2026-42338

MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-05-05 https://github.com/beaugunderson/ip-address GHSA-v2v4-37r5-5v8g
XSS Node.js
5.3
CVSS 4.0 · Vendor: https://github.com/beaugunderson/ip-address
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious IPv6 input
  2. Delivery
    Pass to Address6 constructor
  3. Exploit
    Call .group() method
  4. Execution
    Output contains unescaped markup
  5. Persist
    Render via innerHTML
  6. Impact
    XSS executes in browser context

Vulnerability Assessment

Weakness
CWE
CWE-79
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires two specific conditions to be met simultaneously: (1) The application must pass untrusted input to Address6 constructor, or untrusted input to Address6.link() prefix or className options; AND (2) The application must render the output of Address6.group(), Address6.link(), Address6 constructor error message (AddressError.parseMessage), or v6.helpers.spanAll() as HTML via innerHTML, dangerouslySetInnerHTML, eval(), or equivalent DOM injection API rather than as plain text. Applications using only Address6 for validation and comparison (isValid(), correctForm(), isInSubnet(), bigInt() methods) without rendering HTML-emitting methods are not vulnerable. The vulnerability does not affect default library usage patterns; it only affects applications that: explicitly call group(), link(), or spanAll() methods, OR catch and render AddressError.parseMessage as HTML. No special configuration or non-default deployment mode is required-the vulnerable code paths exist by default but are only reachable through these specific method calls.
Impact

Despite being classified as CWE-79 (XSS), real-world risk is significantly lower than typical XSS vulnerabilities because comprehensive analysis found zero live consumers of the vulnerable methods across 425 npm dependents and public GitHub repositories. Attack surface is limited to applications that: (1) pass untrusted input to Address6 constructor or link() options, AND (2) explicitly render group(), link(), spanAll(), or AddressError.parseMessage output via innerHTML or equivalent DOM injection. The CVSS vector and EPSS score were not provided, preventing quantification of severity. Exploitation requires both unsafe coding practices (rendering HTML-emitting library output as HTML) and untrusted input reaching the library. No KEV status or POC platform confirmation provided, though proof-of-concept code exists in the advisory. The vulnerability is real and exploitable if conditions align, but defenders should prioritize based on their actual use of these specific methods rather than raw CWE-79 severity. Patched version 10.1.1 is available; upgrade priority depends on confirmed usage of vulnerable methods in your codebase.
Exploit ScenarioDerived

An attacker submits a crafted IPv6 address containing HTML markup, such as fe80::1%<img src=x onerror=alert(1)>, to an application that: (1) passes this to the Address6 constructor, (2) calls .group() on the result, and (3) renders the output via document.body.innerHTML. The zone ID (content after %) flows through group() unescaped and embeds the <img> tag verbatim, firing the onerror handler and executing arbitrary JavaScript in the user's browser context. Alternatively, an application accepting untrusted className or prefix parameters to Address6.link() could be exploited via attribute-value injection with onmouseover=alert(1) payload, triggering XSS on mouse hover.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 05, 2026

Cross-site scripting (XSS) vulnerabilities in ip-address library versions up to 10.1.0 allow attackers to inject arbitrary JavaScript code when untrusted input is passed to Address6.group(), Address6.link(), Address6 constructor (via AddressError.parseMessage), or v6.helpers.spanAll() methods and their output is rendered as HTML. The vulnerability affects four separate code paths that fail to HTML-escape user-controlled content before embedding it in returned HTML strings or error messages. Real-world exposure is extremely limited because security research found zero consumers of these HTML-emitting methods across 425 dependent npm packages and public code repositories; applications using only parsing and comparison APIs are unaffected.

RemediationAI

Upgrade ip-address to version 10.1.1 or later immediately. This release includes HTML-escaping in Address6.group(), Address6.link(), Address6 constructor error path, and v6.helpers.spanAll(). If immediate upgrade is not possible, implement one or more of these compensating controls: (1) Validate all input with Address6.isValid() and reject any input containing zone identifiers (% character) or characters outside [0-9a-fA-F:/] before passing to the constructor; (2) Never render output of group(), link(), spanAll(), or AddressError.parseMessage as HTML - treat as text only or use textContent/innerText instead of innerHTML; (3) If HTML rendering is required, sanitize output through DOMPurify (default configuration preserves intended <span> wrapping while stripping injected event handlers) before inserting into DOM; (4) Do not accept untrusted user input in the prefix or className parameters of link() method. See https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g for patch details.

Affected Packages

npm ip-address fix: 10.1.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The ip-address npm package provides IPv6 and IPv4 address parsing and manipulation in JavaScript. The vulnerability stems from unsafe string concatenation in four methods that return HTML-formatted output. Address6.group() uses helpers.simpleGroup() to wrap address segments in <span> elements without escaping zone IDs (IPv6 suffix after %). Address6.link() concatenates user-supplied prefix and className parameters directly into href and class attributes without escaping, enabling attribute injection with event handlers. The Address6 constructor's parse4in6() method concatenates raw input into AddressError.parseMessage HTML via String.replace() before validating characters. v6.helpers.spanAll() injects input characters into class attribute values without escaping. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). CPE: pkg:npm/ip-address affects versions through 10.1.0.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/beaugunderson/ip-address) PRIMARY 5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat 8.1 HIGH

Primary rating from Vendor (https://github.com/beaugunderson/ip-address).

CVSS VectorVendor: https://github.com/beaugunderson/ip-address

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Passive
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
Low
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
CVSS changed
May 12, 2026 - 20:22 NVD
5.3 (MEDIUM)

DescriptionCVE.org

Summary

Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. A related issue in v6.helpers.spanAll() produced malformed markup but was not exploitable; it is hardened in the same release for consistency.

Details

Four related issues were identified and fixed together:

  1. Address6.group(): zone ID injection. The Address6 constructor stores the raw input (including any IPv6 zone ID) in this.address before zone stripping. group() then passed this.address to helpers.simpleGroup(), which wrapped each :-separated segment in a <span> element without HTML-escaping the content. A zone ID containing HTML markup was embedded verbatim.
  2. Address6.link({ prefix, className }): attribute-value injection. link() concatenated user-supplied prefix and className into the href="…" and class="…" attributes without escaping. A caller passing untrusted content through these options could inject event handlers (e.g. onmouseover) and achieve XSS.
  3. Address6 constructor: leading-zero IPv4 error path. The leading-zero branch in parse4in6() built AddressError.parseMessage by concatenating the raw address through String.replace(). Because parse4in6() runs before the bad-character check, any characters in the groups preceding the IPv4 suffix flowed into the error's HTML unescaped. Consumers who render parseMessage as HTML (its documented purpose - it already contains <span class="parse-error"> markup) could be XSS'd by a crafted input such as <img src=x onerror=alert(1)>:10.0.01.1.
  4. v6.helpers.spanAll(): attribute-value injection (defense in depth). spanAll() embedded each character of its input into a class="digit value-${n} …" attribute without escaping. Because split('') limits n to a single character this was not exploitable in practice, but it produced malformed markup and is fixed for consistency.

Affected Versions

All versions up to and including 10.1.0.

Patched Version

10.1.1.

Impact

Real-world exposure is believed to be extremely limited. Analysis of all 425 dependent npm packages as well as GitHub code search found zero consumers of group(), link(), or spanAll(): these HTML-emitting surfaces appear to be unused across published npm packages and public repositories. Applications using only the address-parsing and comparison APIs (isValid, correctForm, isInSubnet, bigInt, etc.) are not affected.

Consumers who do render the output of group(), link(), spanAll(), or AddressError.parseMessage as HTML against untrusted input should upgrade.

PoC

javascript
const { Address6 } = require('ip-address');
const addr = new Address6('fe80::1%<img src=x onerror=alert(1)>');
document.body.innerHTML = addr.group();  // fires the onerror handler in 10.1.0

Workarounds

If users cannot upgrade immediately:

  • Do not pass untrusted input to the Address6 constructor, or
  • Never render the output of group(), link(), or spanAll(), nor the parseMessage field of any thrown AddressError, as HTML; treat these values as text only, or run them through DOMPurify before inserting into the DOM (DOMPurify's default configuration preserves the library's intended <span> wrapping while stripping any injected event handlers), or
  • Validate input with Address6.isValid() and reject anything that contains a zone identifier (a % character) or characters outside [0-9a-fA-F:/] before passing it to the constructor.

Lack of separate CVEs

Given the evidence that these methods are not used, and given that they are all of the same construction, maintainers do not think it's relevant or useful to create a separate CVE for each library method.

Credit

ip-address thanks @scovetta for reporting this issue.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on ip-address (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.1.1.

Threat Intelligence Overview

EPSS Score
0.1%
Top 83% exploitable
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Affected Products (CPE)CVE.org

pkg:npm/ip-address

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2024-35286 CRITICAL POC
9.8 Oct 21

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

References

Advisories & patches
ADVISORY https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g ADVISORY https://vuldb.com/vuln/361292 REF https://access.redhat.com/errata/RHSA-2026:33155 REF https://access.redhat.com/errata/RHSA-2026:33160 REF https://access.redhat.com/errata/RHSA-2026:33163 REF https://access.redhat.com/errata/RHSA-2026:33173 REF https://access.redhat.com/errata/RHSA-2026:33183 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:34374 REF https://access.redhat.com/errata/RHSA-2026:35841 REF https://access.redhat.com/errata/RHSA-2026:35842 REF https://access.redhat.com/errata/RHSA-2026:35891 REF https://access.redhat.com/errata/RHSA-2026:35892 REF https://access.redhat.com/errata/RHSA-2026:36754 REF https://access.redhat.com/errata/RHSA-2026:36820 REF https://access.redhat.com/errata/RHSA-2026:39246 REF https://access.redhat.com/errata/RHSA-2026:39868 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:41947 REF https://access.redhat.com/errata/RHSA-2026:44237 REF https://access.redhat.com/errata/RHSA-2026:44263 REF https://access.redhat.com/errata/RHSA-2026:44267 REF https://access.redhat.com/errata/RHSA-2026:51200 REF https://access.redhat.com/errata/RHSA-2026:52399 REF https://access.redhat.com/errata/RHSA-2026:56928 REF https://access.redhat.com/errata/RHSA-2026:57590 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:62335 REF https://access.redhat.com/errata/RHSA-2026:62336 REF https://access.redhat.com/errata/RHSA-2026:65126 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-42338 REF https://bugzilla.redhat.com/show_bug.cgi?id=2476810 REF https://github.com/advisories/GHSA-v2v4-37r5-5v8g REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42338.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy