ip-address is a JavaScript library for parsing and manipulating IP addresses. Prior to version 10.3.1 the Address4 constructor decodes an octet that begins with a leading zero as decimal, whereas the WHATWG URL host parser and underlying network functions interpret a leading zero octet as octal. This discrepancy causes the library to report an address such as "012.0.0.1" as 12.0.0.1, but the network stack resolves the same string to 10.0.0.1. A defender who relies on the library’s isPrivate(), isLoopback(), or isInSubnet() methods to determine whether a URL refers to an internal host will therefore misclassify internal targets as external, allowing an attacker to perform Server‑Side Request Forgery or bypass trust‑boundary attacks.

All applications that depend on beaugunderson:ip-address prior to version 10.3.1 are affected. The vulnerability exists when the library’s Address4 class parses any IPv4 string containing a leading‑zero octet. Version 10.3.1 and later contain the fix, so any consumer of the library that has not upgraded is vulnerable.

The CVSS score of 7.7 indicates high severity, and although the EPSS score of 0.00292 (≈0.3 %) denotes a very low probability of exploitation, the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a carefully crafted IPv4 address containing a leading‑zero octet (for example 012.0.0.1). Address4 parses this as 12.0.0.1 and reports it as non‑private, but the underlying network stack interprets the same string as 10.0.0.1 and connects to a private host. Consequently, any application that relies on Address4’s classification methods for SSRF filtering or trust‑boundary enforcement may mistakenly allow requests to internal targets. The attack vector is inferred to be remote through an exposed input that feeds the library.