CVE catalog

CVE-2026-42338

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.47% · Oct 25, 2026

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-ip-addresssid10.7.5-1fixed
Debiannode-ip-addressforky10.7.2-1fixed
Debiannode-ip-addresstrixie8.1.0-2vulnerable
Debiannode-ip-addressbookworm8.1.0-2vulnerable
Cpenode-ip-addressNot reportedNot reportedvulnerable
Cpeip-addressNot reported10.1.1fixed
Npmip-addressNot reported10.1.1fixed
Cpeip-addressNot reported10.1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-ip-addresssourcesid10.2.0-2not yet assignedNot reportedNot reported
Debiannode-ip-addresssourceforky10.2.0-2not yet assignedNot reportedNot reported
Debiannode-ip-addresssourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiannode-ip-addresssourcebookworm(unfixed)not yet assignedNot reportedNot reported
Cpeip-addresscpeNot reported10.1.1Not reportedNot reportedNot reported
Npmip-addressnpmNot reported10.1.1Not reportedGHSA-V2V4-37R5-5V8GNot reported
Cpeip-addresscpeNot reported10.1.1Not reportedNVD-CVE-2026-42338Not reported

Notes

[trixie] node-ip-address: Minor issue [bookworm] node-ip-address: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-ip-address]Affected
    Details (2)

    • 8.1.0-2 · all · bookworm

      Affected

      nvd · node-ip-address · debian · bookworm; nvd · node-ip-address · debian · 12

    • 8.1.0-2 · all · bookworm

      Affected

      nvd · node-ip-address · debian · bookworm; nvd · node-ip-address · debian · 12

[Debian 13 (Trixie)]

  • [node-ip-address]Affected
    Details (2)

    • 8.1.0-2 · all · trixie

      Affected

      nvd · node-ip-address · debian · 13

    • 8.1.0-2 · all · trixie

      Affected

      nvd · node-ip-address · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]