The ip-address library contains a flaw in its Address6 isPrivate classifier for the NAT64 local‑use range 64:ff9b:1::/48. The flaw causes the library to treat IP addresses that encode internal IPv4 addresses via that prefix as external, allowing applications that combine isPrivate, isLoopback, and isLinkLocal checks to incorrectly assume trust boundaries. This weakness, catalogued as CWE‑918 and also identified as CWE‑184, can be leveraged to enable SSRF attacks and bypass network boundaries.

The vulnerability impacts the ip-address library maintained by beaugunderson, specifically versions starting at 10.2.0 up to but not including 10.5.1. Any JavaScript application that imports and uses the Address6 logic for determining internal versus external addresses is potentially affected. Systems that have integrated the library into user input processing or internal request routing are in scope.

With a CVSS score of 6.9 the vulnerability poses a medium risk. The EPSS score is < 1%, and the issue is not listed in CISA’s KEV catalog. Exploitation requires the attacker to supply a crafted IPv6 address that falls within the NAT64 local‑use range while the application’s network environment uses an operator‑selected NAT64 prefix in that same range. If successful, the attacker can target internal resources through standard HTTP request flows and can cross the intended trust boundary. The known fix was applied in ip-address v10.5.1, so current versions are not vulnerable.