The ip-address library misclassifies IPv4‑mapped and NAT64 IPv6 addresses as global unicast or NAT64 unnormalized, which causes isLoopback, isUnspecified, isMulticast, isLinkLocal, and isULA checks to fail. Because the library exposes isMapped4() and to4() but does not employ them in these checks, a mapped or NAT64 address can reach internal services through the host OS’s IPv4 stack, enabling an attacker to force the application to send requests to arbitrary internal endpoints. This vulnerability maps to CWE‑20 (Improper Input Validation) and CWE‑918 (Server‑Side Request Forgery) and carries a CVSS score of 6.9, indicating a moderate severity once exploited.

The affected product is the JavaScript library beaugunderson:ip-address. Versions 10.1.1 through 10.2.0 are vulnerable. All dual‑stack hosts that use these versions and rely on the library for address classification or validation are at risk, as the misclassification can bypass trust‑boundary checks and cause SSRF exposures.

The CVSS score of 6.9 suggests moderate impact. The EPSS score of < 1% indicates a very low exploitation probability, though the flaw remains a classic SSRF bypass, making it attractive for attackers when the library is used in server‑side code. The vulnerability is not listed in CISA KEV, but the lack of a mitigation update until 10.2.1 implies that deployments using the vulnerable versions remain exposed until patched. An attacker likely needs to supply a crafted IPv4‑mapped or NAT64 address to a component that processes addresses via this library, which is realistic in many web or microservice backends that rely on ip-address for IP handling. Given the vulnerability’s nature, exploitation can allow internal network enumeration and access to restricted services if the application accepts user‑supplied URLs or addresses.