Bug 2542599 (CVE-2026-101910) - CVE-2026-101910 ip-address: ip-address: Security boundary bypass via unclassified NAT64 local-use address range
Summary: CVE-2026-101910 ip-address: ip-address: Security boundary bypass via unclassi...
Keywords:
Status: NEW
Alias: CVE-2026-101910
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-28 18:05 UTC by OSIDB Bzimport
Modified: 2026-10-15 21:02 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-28 18:05:09 UTC 
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.
Note You need to log in before you can comment on or make changes to this bug.