The library’s Address6.isLinkLocal method mistakenly treats only addresses in the fe80::/64 subnet as link‑local, ignoring the full fe80::/10 link‑local range. An attacker can supply a malicious address elsewhere in fe80::/10, thereby bypassing trust‑boundary checks that rely on isLinkLocal. This flaw is a classic Server‑Side Request Forgery vulnerability (CWE-918) coupled with an incorrect condition verification (CWE-697) and also represents an improper condition detection (CWE-184). The resulting trust‑boundary bypass allows an attacker to reach on‑link hosts or services that were intended to be inaccessible from the external world, potentially exposing sensitive internal endpoints.

Any project that depends on the ip-address library before version 10.5.1 is affected. The issue is present in the beaugunderson:ip-address package and affects JavaScript applications that parse or validate IPv6 addresses using the Address6.isLinkLocal, getType, or getScope functions.

The CVSS score of 6.3 indicates a moderate severity, and the EPSS score is < 1%. The vulnerability is not listed in CISA KEV, suggesting it is not currently known to be exploited in the wild. The likely attack vector is application‑level: an attacker supplies a crafted fe80::/10 IPv6 address to a web application or API that relies on isLinkLocal for trust verification. No authentication is needed beyond normal input handling. Given moderately high attack potential and the absence of specific mitigations in the application, the risk level is considered moderate to high for systems still using the older library version.