{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-101913", "tracking": { "current_release_date": "2026-10-02T05:28:35.384060Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-101913", "initial_release_date": "2026-09-28T18:29:03.410556Z", "revision_history": [ { "date": "2026-09-28T18:29:03.410556Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-09-28T18:29:05.114211Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-28T18:38:39.375058Z", "number": "3", "summary": "CVSS created.| CWES created (2).| Products created (1).| References created (3).| Description created for source.| Unknown change." }, { "date": "2026-09-28T18:38:50.219603Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-09-28T19:38:43.471481Z", "number": "5", "summary": "Unknown change." }, { "date": "2026-09-28T21:40:05.200657Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-09-28T21:40:08.462576Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-09-29T00:21:09.406193Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (4).| CWES updated (1)." }, { "date": "2026-09-29T00:45:04.443510Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| Products connected (1)." }, { "date": "2026-09-29T00:45:13.721389Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-09-29T06:38:46.256792Z", "number": "11", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (55).| References created (5).| CWES updated (1)." }, { "date": "2026-09-29T06:43:54.608331Z", "number": "12", "summary": "Description created for source." }, { "date": "2026-09-29T12:29:40.065832Z", "number": "13", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (4).| Product Identifiers created (1).| References created (5).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-29T12:29:45.405195Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-09-29T16:12:55.674070Z", "number": "15", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-29T18:31:51.321298Z", "number": "16", "summary": "NCSC Score updated." }, { "date": "2026-10-02T05:28:34.888876Z", "number": "17", "summary": "NCSC Score updated." } ], "status": "interim", "version": "17" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-6014972", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_name", "name": "Red Hat Hardened Images" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902830" } } ], "category": "product_name", "name": "grafana12.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902831" } } ], "category": "product_name", "name": "grafana13.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053231" } } ], "category": "product_name", "name": "grafana13.2" } ], "category": "product_family", "name": "Red Hat Hardened Images" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/1.0.0", "product": { "name": "vers:unknown/1.0.0", "product_id": "CSAFPID-8057696" } }, { "category": "product_version_range", "name": "vers:unknown/1.1.0", "product": { "name": "vers:unknown/1.1.0", "product_id": "CSAFPID-8057697" } }, { "category": "product_version_range", "name": "vers:unknown/2.0.0", "product": { "name": "vers:unknown/2.0.0", "product_id": "CSAFPID-8057698" } }, { "category": "product_version_range", "name": "vers:unknown/<10.5.1", "product": { "name": "vers:unknown/<10.5.1", "product_id": "CSAFPID-9482862" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<10.5.1", "product": { "name": "vers:unknown/>=0|<10.5.1", "product_id": "CSAFPID-9483332" } }, { "category": "product_version_range", "name": "vers:unknown/v10.0.0", "product": { "name": "vers:unknown/v10.0.0", "product_id": "CSAFPID-8603576" } }, { "category": "product_version_range", "name": "vers:unknown/v10.0.1", "product": { "name": "vers:unknown/v10.0.1", "product_id": "CSAFPID-8603575" } }, { "category": "product_version_range", "name": "vers:unknown/v10.1.0", "product": { "name": "vers:unknown/v10.1.0", "product_id": "CSAFPID-8603574" } }, { "category": "product_version_range", "name": "vers:unknown/v10.1.1", "product": { "name": "vers:unknown/v10.1.1", "product_id": "CSAFPID-8901868" } }, { "category": "product_version_range", "name": "vers:unknown/v10.2.0", "product": { "name": "vers:unknown/v10.2.0", "product_id": "CSAFPID-8923137" } }, { "category": "product_version_range", "name": "vers:unknown/v10.2.1", "product": { "name": "vers:unknown/v10.2.1", "product_id": "CSAFPID-8932681" } }, { "category": "product_version_range", "name": "vers:unknown/v10.2.2", "product": { "name": "vers:unknown/v10.2.2", "product_id": "CSAFPID-8932680" } }, { "category": "product_version_range", "name": "vers:unknown/v10.3.0", "product": { "name": "vers:unknown/v10.3.0", "product_id": "CSAFPID-8932679" } }, { "category": "product_version_range", "name": "vers:unknown/v10.3.1", "product": { "name": "vers:unknown/v10.3.1", "product_id": "CSAFPID-9485009" } }, { "category": "product_version_range", "name": "vers:unknown/v10.4.0", "product": { "name": "vers:unknown/v10.4.0", "product_id": "CSAFPID-9485008" } }, { "category": "product_version_range", "name": "vers:unknown/v10.5.0", "product": { "name": "vers:unknown/v10.5.0", "product_id": "CSAFPID-9485007" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.1", "product": { "name": "vers:unknown/v2.0.1", "product_id": "CSAFPID-8603617" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.2", "product": { "name": "vers:unknown/v2.0.2", "product_id": "CSAFPID-8603616" } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.0", "product": { "name": "vers:unknown/v3.1.0", "product_id": "CSAFPID-8603615" } }, { "category": "product_version_range", "name": "vers:unknown/v5.2.0", "product": { "name": "vers:unknown/v5.2.0", "product_id": "CSAFPID-8603614" } }, { "category": "product_version_range", "name": "vers:unknown/v5.3.0", "product": { "name": "vers:unknown/v5.3.0", "product_id": "CSAFPID-8603613" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.0", "product": { "name": "vers:unknown/v5.4.0", "product_id": "CSAFPID-8603612" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.1", "product": { "name": "vers:unknown/v5.4.1", "product_id": "CSAFPID-8603611" } }, { "category": "product_version_range", "name": "vers:unknown/v5.5.0", "product": { "name": "vers:unknown/v5.5.0", "product_id": "CSAFPID-8603610" } }, { "category": "product_version_range", "name": "vers:unknown/v5.6.0", "product": { "name": "vers:unknown/v5.6.0", "product_id": "CSAFPID-8603609" } }, { "category": "product_version_range", "name": "vers:unknown/v5.7.0", "product": { "name": "vers:unknown/v5.7.0", "product_id": "CSAFPID-8603608" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.0", "product": { "name": "vers:unknown/v5.8.0", "product_id": "CSAFPID-8603607" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.1", "product": { "name": "vers:unknown/v5.8.1", "product_id": "CSAFPID-8603606" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.2", "product": { "name": "vers:unknown/v5.8.2", "product_id": "CSAFPID-8603605" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.3", "product": { "name": "vers:unknown/v5.8.3", "product_id": "CSAFPID-8603604" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.4", "product": { "name": "vers:unknown/v5.8.4", "product_id": "CSAFPID-8603603" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.5", "product": { "name": "vers:unknown/v5.8.5", "product_id": "CSAFPID-8603602" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.6", "product": { "name": "vers:unknown/v5.8.6", "product_id": "CSAFPID-8603601" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.7", "product": { "name": "vers:unknown/v5.8.7", "product_id": "CSAFPID-8603600" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.8", "product": { "name": "vers:unknown/v5.8.8", "product_id": "CSAFPID-8603599" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.9", "product": { "name": "vers:unknown/v5.8.9", "product_id": "CSAFPID-8603598" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.0", "product": { "name": "vers:unknown/v5.9.0", "product_id": "CSAFPID-8603597" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.1", "product": { "name": "vers:unknown/v5.9.1", "product_id": "CSAFPID-8603596" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.2", "product": { "name": "vers:unknown/v5.9.2", "product_id": "CSAFPID-8603595" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.3", "product": { "name": "vers:unknown/v5.9.3", "product_id": "CSAFPID-8603594" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.4", "product": { "name": "vers:unknown/v5.9.4", "product_id": "CSAFPID-8603593" } }, { "category": "product_version_range", "name": "vers:unknown/v6.0.0", "product": { "name": "vers:unknown/v6.0.0", "product_id": "CSAFPID-8603592" } }, { "category": "product_version_range", "name": "vers:unknown/v6.1.0", "product": { "name": "vers:unknown/v6.1.0", "product_id": "CSAFPID-8603591" } }, { "category": "product_version_range", "name": "vers:unknown/v6.2.0", "product": { "name": "vers:unknown/v6.2.0", "product_id": "CSAFPID-8603590" } }, { "category": "product_version_range", "name": "vers:unknown/v6.3.0", "product": { "name": "vers:unknown/v6.3.0", "product_id": "CSAFPID-8603589" } }, { "category": "product_version_range", "name": "vers:unknown/v6.4.0", "product": { "name": "vers:unknown/v6.4.0", "product_id": "CSAFPID-8603588" } }, { "category": "product_version_range", "name": "vers:unknown/v7.0.0", "product": { "name": "vers:unknown/v7.0.0", "product_id": "CSAFPID-8603587" } }, { "category": "product_version_range", "name": "vers:unknown/v7.0.1", "product": { "name": "vers:unknown/v7.0.1", "product_id": "CSAFPID-8603586" } }, { "category": "product_version_range", "name": "vers:unknown/v7.1.0", "product": { "name": "vers:unknown/v7.1.0", "product_id": "CSAFPID-8603585" } }, { "category": "product_version_range", "name": "vers:unknown/v8.0.0", "product": { "name": "vers:unknown/v8.0.0", "product_id": "CSAFPID-8603584" } }, { "category": "product_version_range", "name": "vers:unknown/v8.1.0", "product": { "name": "vers:unknown/v8.1.0", "product_id": "CSAFPID-8603583" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.0", "product": { "name": "vers:unknown/v9.0.0", "product_id": "CSAFPID-8603582" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.1", "product": { "name": "vers:unknown/v9.0.1", "product_id": "CSAFPID-8603581" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.2", "product": { "name": "vers:unknown/v9.0.2", "product_id": "CSAFPID-8603580" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.3", "product": { "name": "vers:unknown/v9.0.3", "product_id": "CSAFPID-8603579" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.5", "product": { "name": "vers:unknown/v9.0.5", "product_id": "CSAFPID-8603578" } }, { "category": "product_version_range", "name": "vers:unknown/v9.1.0-0", "product": { "name": "vers:unknown/v9.1.0-0", "product_id": "CSAFPID-8603577" } } ], "category": "product_name", "name": "ip-address" } ], "category": "vendor", "name": "beaugunderson" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-7088727" } } ], "category": "product_name", "name": "node-ip-address" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-101913", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "description", "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-101913" }, { "category": "description", "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-101913" }, { "category": "description", "text": "### Summary\n\n`Address6.isLinkLocal()` recognizes `fe80::/64` rather than `fe80::/10`. Link-local unicast is the whole `/10` under RFC 4291 §2.4 and the IANA IPv6 Special-Purpose Address Registry, so the method returns `false` for every link-local address outside the one `/64` that stateless address autoconfiguration happens to use. `new Address6('fe81::1').isLinkLocal()` is `false`.\n\nThe library contradicts itself on the same object: for `fe81::1`, `getType()` returns `'Link-local unicast'`, `getScope()` returns `'Link local'`, and `isHostInSubnet(new Address6('fe80::/10'))` returns `true`, while `isLinkLocal()` returns `false`.\n\nAn application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) will classify a link-local target as unremarkable and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach.\n\n### Details\n\n`isLinkLocal()` in `src/ipv6.ts` compares the first 64 bits of the address against a literal string:\n\n```ts\n// Zeroes are required, i.e. we can't check isHostInSubnet with 'fe80::/10'\nif (\n this.getBitsBase2(0, 64) ===\n '1111111010000000000000000000000000000000000000000000000000000000'\n) {\n return true;\n}\n```\n\nThe comparison requires the first 64 bits to be exactly `fe80:0000:0000:0000`, so it accepts 2⁶⁴ of the 2¹¹⁸ addresses in `fe80::/10`. The comment states a premise the library disproves: `getType()` classifies the same range with `isHostInSubnet` against the `'fe80::/10': 'Link-local unicast'` entry in `src/v6/constants.ts`, and `Address4.isLinkLocal()` is a plain `isHostInSubnet` test against `169.254.0.0/16`. RFC 4291 §2.5.6 constrains the format of an autoconfigured link-local address; it does not define the range, and reading it as the definition is the likeliest origin of the `/64` comparison.\n\nThe IPv4-mapped and NAT64 well-known paths of `isLinkLocal()` are unaffected: `::ffff:169.254.169.254` and `64:ff9b::a9fe:a9fe` are classified by their embedded IPv4 address and report `true`.\n\n### Affected versions\n\n`<= 10.5.0`. The comparison has had this shape since `Address6.isLinkLocal()` was introduced, so every release exposing the method is affected.\n\n### Impact\n\nEvery well-formed address in `fe80::/10` outside `fe80::/64` is parsed successfully, `isValid()` is `true`, and the classifier reports something untrue about it. No other classifier catches these addresses: `isPrivate()` covers ULA (`fc00::/7`), not link-local.\n\n| Address | `isLinkLocal()` | `getType()` | `getScope()` |\n|---|---|---|---|\n| `fe80::1` | `true` | Link-local unicast | Link local |\n| `fe81::1` | `false` | Link-local unicast | Link local |\n| `fe8f::1` | `false` | Link-local unicast | Link local |\n| `febf::1` | `false` | Link-local unicast | Link local |\n| `fe80:0:0:1::1` | `false` | Link-local unicast | Link local |\n| `fe80::1:0:0:0:1` | `false` | Link-local unicast | Link local |\n\nPython's `ipaddress` module, the `IN6_IS_ADDR_LINKLOCAL` macro in `netinet6/in6.h`, and Linux's `ipv6_addr_type()` all apply a ten-bit prefix test and classify every row above as link-local.\n\nA request admitted through a guard built on `isLinkLocal()` reaches a link-local host on the server's own segment: a neighboring machine or the on-link router. An IPv6 link-local destination generally needs a zone index and a neighbor on the same link, so the reach is the server's own segment rather than the internet or a universal metadata endpoint, and the severity reflects that.\n\n### Proof of concept\n\n`npm i ip-address@10.5.0`, then:\n\n```js\nconst { Address6 } = require('ip-address');\n\n// A guard of the shape the library documents.\nfunction isBlocked(host) {\n const a = new Address6(host);\n return a.isLoopback() || a.isLinkLocal() || a.isPrivate() || a.isMulticast() || a.isUnspecified();\n}\n\nfor (const h of ['fe80::1', 'fe81::1', 'febf::1', 'fe80:0:0:1::1']) {\n const a = new Address6(h);\n console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h, '-> getType()', a.getType());\n}\n```\n\nOn affected versions:\n\n```\nBLOCK fe80::1 -> getType() Link-local unicast\nALLOW fe81::1 -> getType() Link-local unicast\nALLOW febf::1 -> getType() Link-local unicast\nALLOW fe80:0:0:1::1 -> getType() Link-local unicast\n```\n\n### Remediation\n\nUpgrade to the patched release. In the fix, `isLinkLocal()` tests the address against `fe80::/10` with the same `isHostInSubnet` predicate `getType()` and `Address4.isLinkLocal()` use. The same release adds `2001::/32` to the type table so `getType()` reports `'Teredo'` for the addresses `isTeredo()` returns `true` for; that is a consistency correction with no security effect.\n\nIf you cannot upgrade immediately, test the range directly:\n\n```js\nconst LINK_LOCAL = new Address6('fe80::/10');\nconst linkLocal = new Address6(host).isHostInSubnet(LINK_LOCAL);\n```\n\n### A note on SSRF defense\n\nThese methods are address classifiers, not a complete SSRF defense. Regardless of this fix, a robust SSRF guard must resolve the hostname and validate the *resolved* IP against the socket it connects to, and account for DNS rebinding and redirects. Treat these checks as one layer, not the only one.", "title": "github - https://github.com/advisories/GHSA-rpw4-54j3-4h4q" }, { "category": "description", "text": "### Summary\n\n`Address6.isLinkLocal()` recognizes `fe80::/64` rather than `fe80::/10`. Link-local unicast is the whole `/10` under RFC 4291 §2.4 and the IANA IPv6 Special-Purpose Address Registry, so the method returns `false` for every link-local address outside the one `/64` that stateless address autoconfiguration happens to use. `new Address6('fe81::1').isLinkLocal()` is `false`.\n\nThe library contradicts itself on the same object: for `fe81::1`, `getType()` returns `'Link-local unicast'`, `getScope()` returns `'Link local'`, and `isHostInSubnet(new Address6('fe80::/10'))` returns `true`, while `isLinkLocal()` returns `false`.\n\nAn application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) will classify a link-local target as unremarkable and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach.\n\n### Details\n\n`isLinkLocal()` in `src/ipv6.ts` compares the first 64 bits of the address against a literal string:\n\n```ts\n// Zeroes are required, i.e. we can't check isHostInSubnet with 'fe80::/10'\nif (\n this.getBitsBase2(0, 64) ===\n '1111111010000000000000000000000000000000000000000000000000000000'\n) {\n return true;\n}\n```\n\nThe comparison requires the first 64 bits to be exactly `fe80:0000:0000:0000`, so it accepts 2⁶⁴ of the 2¹¹⁸ addresses in `fe80::/10`. The comment states a premise the library disproves: `getType()` classifies the same range with `isHostInSubnet` against the `'fe80::/10': 'Link-local unicast'` entry in `src/v6/constants.ts`, and `Address4.isLinkLocal()` is a plain `isHostInSubnet` test against `169.254.0.0/16`. RFC 4291 §2.5.6 constrains the format of an autoconfigured link-local address; it does not define the range, and reading it as the definition is the likeliest origin of the `/64` comparison.\n\nThe IPv4-mapped and NAT64 well-known paths of `isLinkLocal()` are unaffected: `::ffff:169.254.169.254` and `64:ff9b::a9fe:a9fe` are classified by their embedded IPv4 address and report `true`.\n\n### Affected versions\n\n`<= 10.5.0`. The comparison has had this shape since `Address6.isLinkLocal()` was introduced, so every release exposing the method is affected.\n\n### Impact\n\nEvery well-formed address in `fe80::/10` outside `fe80::/64` is parsed successfully, `isValid()` is `true`, and the classifier reports something untrue about it. No other classifier catches these addresses: `isPrivate()` covers ULA (`fc00::/7`), not link-local.\n\n| Address | `isLinkLocal()` | `getType()` | `getScope()` |\n|---|---|---|---|\n| `fe80::1` | `true` | Link-local unicast | Link local |\n| `fe81::1` | `false` | Link-local unicast | Link local |\n| `fe8f::1` | `false` | Link-local unicast | Link local |\n| `febf::1` | `false` | Link-local unicast | Link local |\n| `fe80:0:0:1::1` | `false` | Link-local unicast | Link local |\n| `fe80::1:0:0:0:1` | `false` | Link-local unicast | Link local |\n\nPython's `ipaddress` module, the `IN6_IS_ADDR_LINKLOCAL` macro in `netinet6/in6.h`, and Linux's `ipv6_addr_type()` all apply a ten-bit prefix test and classify every row above as link-local.\n\nA request admitted through a guard built on `isLinkLocal()` reaches a link-local host on the server's own segment: a neighboring machine or the on-link router. An IPv6 link-local destination generally needs a zone index and a neighbor on the same link, so the reach is the server's own segment rather than the internet or a universal metadata endpoint, and the severity reflects that.\n\n### Proof of concept\n\n`npm i ip-address@10.5.0`, then:\n\n```js\nconst { Address6 } = require('ip-address');\n\n// A guard of the shape the library documents.\nfunction isBlocked(host) {\n const a = new Address6(host);\n return a.isLoopback() || a.isLinkLocal() || a.isPrivate() || a.isMulticast() || a.isUnspecified();\n}\n\nfor (const h of ['fe80::1', 'fe81::1', 'febf::1', 'fe80:0:0:1::1']) {\n const a = new Address6(h);\n console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h, '-> getType()', a.getType());\n}\n```\n\nOn affected versions:\n\n```\nBLOCK fe80::1 -> getType() Link-local unicast\nALLOW fe81::1 -> getType() Link-local unicast\nALLOW febf::1 -> getType() Link-local unicast\nALLOW fe80:0:0:1::1 -> getType() Link-local unicast\n```\n\n### Remediation\n\nUpgrade to the patched release. In the fix, `isLinkLocal()` tests the address against `fe80::/10` with the same `isHostInSubnet` predicate `getType()` and `Address4.isLinkLocal()` use. The same release adds `2001::/32` to the type table so `getType()` reports `'Teredo'` for the addresses `isTeredo()` returns `true` for; that is a consistency correction with no security effect.\n\nIf you cannot upgrade immediately, test the range directly:\n\n```js\nconst LINK_LOCAL = new Address6('fe80::/10');\nconst linkLocal = new Address6(host).isHostInSubnet(LINK_LOCAL);\n```\n\n### A note on SSRF defense\n\nThese methods are address classifiers, not a complete SSRF defense. Regardless of this fix, a robust SSRF guard must resolve the hostname and validate the *resolved* IP against the socket it connects to, and account for DNS rebinding and redirects. Treat these checks as one layer, not the only one.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-rpw4-54j3-4h4q.json?alt=media" }, { "category": "description", "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101913.json?alt=media" }, { "category": "description", "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-101913" }, { "category": "description", "text": "A flaw was found in ip-address. The library fails to validate the complete range of IPv6 link-local addresses during address classification checks. A remote attacker can provide a specially crafted IPv6 address to bypass security controls that rely on this verification. Successful exploitation can allow an attacker to bypass trust boundaries and communicate with restricted internal network hosts.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-101913" }, { "category": "other", "text": "0.00386", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "6.3", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.2", "title": "NCSC Score" }, { "category": "other", "text": "There is cwe data available from source Nvd, Is related to (a version of) an uncommon product", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 2\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-9482862", "CSAFPID-9483332", "CSAFPID-7088727", "CSAFPID-8057696", "CSAFPID-8057697", "CSAFPID-8057698", "CSAFPID-8603574", "CSAFPID-8603575", "CSAFPID-8603576", "CSAFPID-8603577", "CSAFPID-8603578", "CSAFPID-8603579", "CSAFPID-8603580", "CSAFPID-8603581", "CSAFPID-8603582", "CSAFPID-8603583", "CSAFPID-8603584", "CSAFPID-8603585", "CSAFPID-8603586", "CSAFPID-8603587", "CSAFPID-8603588", "CSAFPID-8603589", "CSAFPID-8603590", "CSAFPID-8603591", "CSAFPID-8603592", "CSAFPID-8603593", "CSAFPID-8603594", "CSAFPID-8603595", "CSAFPID-8603596", "CSAFPID-8603597", "CSAFPID-8603598", "CSAFPID-8603599", "CSAFPID-8603600", "CSAFPID-8603601", "CSAFPID-8603602", "CSAFPID-8603603", "CSAFPID-8603604", "CSAFPID-8603605", "CSAFPID-8603606", "CSAFPID-8603607", "CSAFPID-8603608", "CSAFPID-8603609", "CSAFPID-8603610", "CSAFPID-8603611", "CSAFPID-8603612", "CSAFPID-8603613", "CSAFPID-8603614", "CSAFPID-8603615", "CSAFPID-8603616", "CSAFPID-8603617", "CSAFPID-8901868", "CSAFPID-8923137", "CSAFPID-8932679", "CSAFPID-8932680", "CSAFPID-8932681", "CSAFPID-9485007", "CSAFPID-9485008", "CSAFPID-9485009", "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-9053231" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101913" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-101913" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101913" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-rpw4-54j3-4h4q.json?alt=media" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-101913" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101913.json?alt=media" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-101913" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101913" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101913.json" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101913" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-6014972", "CSAFPID-7088727", "CSAFPID-8057696", "CSAFPID-8057697", "CSAFPID-8057698", "CSAFPID-8603574", "CSAFPID-8603575", "CSAFPID-8603576", "CSAFPID-8603577", "CSAFPID-8603578", "CSAFPID-8603579", "CSAFPID-8603580", "CSAFPID-8603581", "CSAFPID-8603582", "CSAFPID-8603583", "CSAFPID-8603584", "CSAFPID-8603585", "CSAFPID-8603586", "CSAFPID-8603587", "CSAFPID-8603588", "CSAFPID-8603589", "CSAFPID-8603590", "CSAFPID-8603591", "CSAFPID-8603592", "CSAFPID-8603593", "CSAFPID-8603594", "CSAFPID-8603595", "CSAFPID-8603596", "CSAFPID-8603597", "CSAFPID-8603598", "CSAFPID-8603599", "CSAFPID-8603600", "CSAFPID-8603601", "CSAFPID-8603602", "CSAFPID-8603603", "CSAFPID-8603604", "CSAFPID-8603605", "CSAFPID-8603606", "CSAFPID-8603607", "CSAFPID-8603608", "CSAFPID-8603609", "CSAFPID-8603610", "CSAFPID-8603611", "CSAFPID-8603612", "CSAFPID-8603613", "CSAFPID-8603614", "CSAFPID-8603615", "CSAFPID-8603616", "CSAFPID-8603617", "CSAFPID-8901868", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-8923137", "CSAFPID-8932679", "CSAFPID-8932680", "CSAFPID-8932681", "CSAFPID-9053231", "CSAFPID-9482862", "CSAFPID-9483332", "CSAFPID-9485007", "CSAFPID-9485008", "CSAFPID-9485009" ] } ], "title": "CVE-2026-101913" } ] }