Bundled ip-address dependency vulnerable to SSRF (CVE-2026-69192 / GHSA-mwp4-54f8-5fhr)
@martinrrm is already working on this.
Since Aug 25, 2026.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Description
npm bundles ip-address@10.2.0 (via make-fetch-happen → @npmcli/agent → socks-proxy-agent → socks), which is affected by GHSA-mwp4-54f8-5fhr / CVE-2026-69192 (high severity). Address4 decodes leading-zero octets as decimal while resolvers (WHATWG URL, inet_aton, getaddrinfo) decode them as octal, which can allow SSRF / trust-boundary bypass.
The issue is fixed upstream in ip-address@10.3.1 (released 2026-07-25). socks@2.8.9's own dependency range (^10.1.1) already permits this fixed version, but npm's own bundled lockfile hasn't been refreshed to pick it up — the latest published CLI versions (11.19.0 and 12.0.2, both from 2026-07-29) still ship the vulnerable ip-address@10.2.0.
Expected Behavior
A new npm CLI release with a refreshed lockfile bundling ip-address@10.3.1 or later.
Actual Behavior
Latest npm CLI releases (checked 11.19.0, 12.0.0, 12.0.1, 12.0.2) all bundle ip-address@10.2.0.
Steps To Reproduce
npm pack npm@12.0.2
tar -xzf npm-12.0.2.tgz -O package/node_modules/ip-address/package.json | grep version
# => "version": "10.2.0"
Environment
- npm: 11.19.0 / 12.0.2
- Advisory: https://github.com/advisories/GHSA-mwp4-54f8-5fhr
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.