CVE-2026-101913

Name of the Vulnerable Software and Affected Versions ip-address versions prior to 10.5.1

Description The Address6.isLinkLocal() method in src/ipv6.ts incorrectly recognizes only the fe80::/64 range instead of the full fe80::/10 IPv6 link-local range. This creates an inconsistency where the same address may be identified as link-local by getType() and getScope() but return false when checked via isLinkLocal(). An attacker can use an address within the fe80::/10 range to bypass trust-boundary checks, such as filters designed to prevent Server-Side Request Forgery (SSRF). SSRF is an attack where a user-supplied address tricks a server into making requests to internal destinations that are otherwise inaccessible. A successful bypass allows a request to reach an on-link host, such as a neighboring machine or a router on the server's own network segment.

Recommendations Update to version 10.5.1. As a temporary workaround, verify the link-local range by using the isHostInSubnet() function against the fe80::/10 subnet instead of relying on the isLinkLocal() method.