ip-address is a JavaScript library that parses IPv4 and IPv6 addresses and offers methods to determine whether an address is special‑use such as loopback, private, or multicast. In versions 10.1.1 through 10.2.2 the special‑use checks rely on an internal call that first tests whether the parsed address’s subnet mask is longer than the reference range’s mask. Because the mask is taken directly from the CIDR suffix supplied in the input string, an attacker can append a suffix such as "/0" to force all special‑use tests to report false. Consequently any application that uses these tests to decide whether a URL is allowed for a potential SSRF request will treat an internal address as external and permit the request, allowing the attacker to reach otherwise‑protected internal services. The flaw involves improper input validation and address manipulation, corresponding to CWE‑1389, CWE‑20, and CWE‑918.

Any project that includes the ip-address library from beaugunderson, version 10.1.1 up to but excluding 10.2.2, is vulnerable. The issue is fixed in version 10.2.2, so only installations that have not yet applied this update are affected. It is not limited to any particular distribution, and the vulnerability exists regardless of how the package is installed or bundled.

The CVSS score of 6.9 indicates a moderate severity issue. The EPSS score of < 1 % indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by supplying a crafted IP address string with a short CIDR suffix to any code that parses the address using ip-address to determine trust boundaries. Once the check is bypassed, internal network hosts become reachable via SSRF or other privileged requests. This attack can be performed from the network where the application is exposed to user input.