PT-2026-99955

CVE-2026-101912

Published

2026-09-28

Updated

2026-10-31

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ip-address versions prior to 10.7.1

Description The isInSubnet() and isHostInSubnet() functions in src/common.ts compare masked binary strings without verifying if both operands belong to the same IP family. This allows a cross-family containment check to return a match if the leading address bits are identical, despite IPv4 and IPv6 occupying different address spaces. Consequently, an allowlist or denylist may incorrectly classify an address as being within the intended range.

Recommendations Update to version 10.7.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Waydeshi

Vendors

Affected products

Weakness enumeration

CWE-697: Incorrect Comparison

CWE-843: Access of Resource Using Incompatible Type (\'Type Confusion\')