{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/ip-address--10.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-69192"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ip-address (\u003c= 10.3.0)"],"_cs_severities":["high"],"_cs_tags":["ssrf","library-vulnerability","supply-chain"],"_cs_type":"advisory","_cs_vendors":["npm"],"content_html":"\u003cp\u003eThe ip-address npm package (versions 10.3.0 and below) contains a critical flaw in its IPv4 parsing logic that creates an address-classification discrepancy between the application-layer guard and the underlying network resolver. The library's \u003ccode\u003eAddress4.parse\u003c/code\u003e logic uses a regular expression that permits octets with leading zeros, which it then decodes as decimal. However, standard network resolvers and the WHATWG URL host parser interpret such leading-zero octets as octal (base 8).\u003c/p\u003e\n\u003cp\u003eThis discrepancy allows an attacker to bypass security filters built on top of this library. For example, the host '012.0.0.1' is classified by the library as a public/external address, but when passed to a network utility or \u003ccode\u003efetch\u003c/code\u003e request, the OS resolver interprets it as '10.0.0.1', a private RFC 1918 address. Applications relying on this library to validate URLs or block SSRF (Server-Side Request Forgery) will fail to detect these obfuscated internal addresses, allowing malicious requests to reach restricted internal infrastructure, such as management interfaces or metadata services.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application utilizing the ip-address library to perform SSRF filtering or trust-boundary validation.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an IPv4 address string using octal-ambiguous notation (e.g., '012.0.0.1') corresponding to a sensitive internal resource.\u003c/li\u003e\n\u003cli\u003eThe application passes this string to \u003ccode\u003enew Address4(host)\u003c/code\u003e for security validation.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eAddress4\u003c/code\u003e validates the string as a non-private IPv4 address (or a non-loopback address) because it treats the leading zero as a decimal identifier.\u003c/li\u003e\n\u003cli\u003eThe application security logic concludes the host is safe (not internal) and permits the request.\u003c/li\u003e\n\u003cli\u003eThe application subsequently passes the untrusted string to a native URL parser or network request library (e.g., \u003ccode\u003efetch\u003c/code\u003e, \u003ccode\u003eaxios\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe network resolver interprets the leading zero as octal, resolving the address to an internal target (e.g., 10.0.0.1).\u003c/li\u003e\n\u003cli\u003eThe final network request is dispatched to the prohibited internal destination, resulting in successful SSRF.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in SSRF, allowing attackers to access internal-only services, cloud metadata endpoints, or local network resources that are shielded from the public internet. This bypass is effective because the obfuscation technique is compatible with standard URL parsing and network stacks, requiring no specialized tooling. The vulnerability affects any application that relies on \u003ccode\u003eip-address\u003c/code\u003e to block internal IP ranges without performing secondary host resolution and socket-level verification.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eip-address\u003c/code\u003e package to a patched version immediately.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, implement an input filter that rejects any host whose octets contain a leading zero before passing it to the library: \u003ccode\u003eif (host.split('.').some((octet) =\u0026gt; /^0\\d/.test(octet))) throw new Error('ambiguous address');\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnsure that all SSRF guards are implemented as multi-layered defenses. Do not rely solely on parsing libraries; perform actual DNS resolution of hostnames and validate the resolved IP against an allowed-list before establishing a socket connection.\u003c/li\u003e\n\u003cli\u003eEnsure security checks account for DNS rebinding and redirects, as static address validation is insufficient to prevent all SSRF scenarios.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-03T20:48:07Z","date_published":"2026-08-03T20:48:07Z","id":"https://feed.craftedsignal.io/briefs/2026-08-ip-address-ssrf/","summary":"The ip-address library versions 10.3.0 and below incorrectly parse IPv4 addresses with leading zeros, leading to trust-boundary bypasses and SSRF when used to filter internal network access.","title":"SSRF via Ambiguous IPv4 Parsing in ip-address Library","url":"https://feed.craftedsignal.io/briefs/2026-08-ip-address-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Ip-Address (\u003c= 10.3.0)","version":"https://jsonfeed.org/version/1.1"}