CVE•Published 2026-09-28•Modified 2026-09-30•0 articles on news•4 live references•NVD data

CVE-2026-101913

Vulnerability data via NVD (ingested)

CVSS v3.1

—

EPSS percentile

—

Weaknesses (CWE)

CWE-697Incorrect Comparison CWE-918Server-Side Request Forgery

Description

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.

Timeline

Published 2026-09-28

Modified 2026-09-30

External references

NVD MITRE GitHub PoC VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-101913

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2026-101913

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-101913

Censys host search filtered to this CVE id.

grep.app

CVE-2026-101913