{"uuid": "2bd49c3d-4ffb-4b3b-ad7e-b6be49cb9c2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54272", "type": "seen", "source": "https://gist.github.com/alon710/539d26ece962aef59230f2218cc50bae", "content": "# CVE-2026-54272: CVE-2026-54272: SSRF and Trust-Boundary Bypass via Input Misclassification in ip-address Library\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54272\n\n## Summary\nA trust-boundary bypass and Server-Side Request Forgery (SSRF) vulnerability exists in the ip-address library versions 10.1.1 through 10.2.0 due to structural input misclassification. The library fails to resolve and normalize transition IP notations, such as IPv4-mapped IPv6 (::ffff:0:0/96) and NAT64 (64:ff9b::/96) addresses, to their embedded IPv4 representations prior to evaluation. Consequently, standard security validation checks (e.g., isLoopback, isLinkLocal, isULA) return false for these addresses. This allows remote attackers to bypass application-level IP address filters, gaining unauthorized access to internal resources, cloud metadata interfaces, and local services on dual-stack hosts or environments utilizing NAT64 gateways.\n\n## TL;DR\nInput misclassification in ip-address library <= 10.2.0 enables SSRF. The parser fails to normalize IPv4-mapped or NAT64 transition addresses before running boolean classification checks (e.g., isLoopback). This allows attackers to bypass security guards and connect to restricted internal IPv4 destinations over dual-stack host configurations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918, CWE-20\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00254 (0.25%)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications incorporating npm package ip-address for IP validation\n- Dual-stack host configurations running vulnerable validation services\n- Environments utilizing NAT64/DNS64 translations with permissive HTTP proxies\n- **ip-address**: >= 10.1.1, <= 10.2.0 (Fixed in: `10.2.1`)\n\n## Mitigation\n\n- Upgrade dependency trees immediately to ip-address version 10.2.1 or newer.\n- Implement DNS lookup resolution first and validate the resolved IP addresses directly.\n- Deploy WAF rules to detect and drop transition IP notations at the perimeter.\n- Ensure HTTP clients establish connections directly to validated IP addresses rather than raw hostnames to prevent DNS Rebinding.\n\n**Remediation Steps:**\n1. Update your project dependencies: run 'npm install ip-address@10.2.1' or verify nested occurrences via dependency locking tools.\n2. Refactor backend validation logic to check ip.isPrivate() and ip.isLoopback() on parsed instances.\n3. Ensure to address-pin HTTP client configurations using the resolved IP address while overriding the HTTP Host header.\n\n## References\n\n- [GHSA-22jq-vg5j-6vgg: SSRF bypass through transition addresses](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg)\n- [Fix implementation commit](https://github.com/beaugunderson/ip-address/commit/e86ab3e19588761ce18caf4820b26f01ac25043b)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54272) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T10:32:20.331358Z"}