Listen to this Post
The `ip-address` library’s `Address4` class accepts IPv4 octets with leading zeros and decodes them as decimal, while the WHATWG URL parser, inet_aton, and `getaddrinfo` all interpret leading zeros as octal. This discrepancy causes the library and the network stack to resolve the same string to different IP addresses. For example, `new Address4(‘012.0.0.1’)` reports `correctForm()` as `12.0.0.1` and `isPrivate()` as false, but `fetch(‘http://012.0.0.1/’)` connects to 10.0.0.1. An application using these checks for network trust-boundary decisions, such as an SSRF filter, will misclassify an internal target as external and allow the request. The `Address4.parse` method gates input using the regex (25[0-5]|2[0-4][0-9]|
?[0-9][0-9]?)</code>, where the `[bash]?[0-9][0-9]?` branch matches leading zeros. Every downstream consumer—<code>isPrivate()</code>, <code>isLoopback()</code>, <code>isLinkLocal()</code>, <code>isCGNAT()</code>, <code>isInSubnet()</code>, <code>isHostInSubnet()</code>, and <code>correctForm()</code>—inherits this mis-decoding. `Address6` already rejects this notation, making `Address4` the outlier. Affected versions are <= 10.3.0. The under-blocking case is security-relevant, while over-blocking affects correctness and availability. The attack vector is a legal URL host, so exploitation requires no unusual application shape. The proof of concept demonstrates that `012.0.0.1` and `012.012.012.012` are allowed through an `isPrivate()` guard but resolve to internal addresses. The fix in the patched release rejects any octet with a leading zero followed by digits. However, `Address4.isValid()` returning `false` does not mean the address is safe; many other forms like `0177.0.0.1` and `0x7f.0.0.1` still resolve to loopback. A robust SSRF defense must resolve the hostname and validate the resolved IP, accounting for DNS rebinding and redirects. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: ip-address library Version: <= 10.3.0 Vulnerability: Address4 octal/decimal mismatch Severity: Critical date: 2026-08-03 <h2 style="color: blue;">Prediction: 2026-08-03 (patch released in 10.3.1)</h2> <h2 style="color: blue;">What Undercode Say:</h2> Analytics show the parsing flaw enables SSRF and trust-boundary bypass. The library's `Address4.parse` regex and `parseInt(part, 10)` cause the inconsistency. The following commands and code demonstrate the issue: [bash] npm i [email protected]
const { Address4 } = require('ip-address');
function isBlocked(host) {
return Address4.isValid(host) && new Address4(host).isPrivate();
}
for (const h of ['10.0.0.1', '012.0.0.1', '012.012.012.012']) {
console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h,
'-> resolver reaches', new URL('http://' + h + '/').hostname);
}
// Output on affected versions:
// BLOCK 10.0.0.1 -> resolver reaches 10.0.0.1
// ALLOW 012.0.0.1 -> resolver reaches 10.0.0.1
// ALLOW 012.012.012.012 -> resolver reaches 10.10.10.10
Exploit:
An attacker provides a user-supplied address like `012.0.0.1` or 012.012.012.012. The application's `isPrivate()` check returns false, classifying the address as public. The server then makes a request to the resolved address (e.g., `10.0.0.1` or 10.10.10.10), which is internal. This allows the attacker to access internal services, such as cloud metadata endpoints, that would otherwise be unreachable.
Protection:
Upgrade to the patched release (10.3.1 or later). If immediate upgrade is not possible, reject any host whose octets have a leading zero before parsing:
if (host.split('.').some((octet) => /^0\d/.test(octet))) throw new Error('ambiguous address');
Additionally, implement a robust SSRF defense that resolves the hostname and validates the resolved IP against the actual socket connection, accounting for DNS rebinding and redirects. Do not treat `Address4.isValid()` returning `false` as a safe condition; always resolve and re-check.
Impact:
The vulnerability allows SSRF and trust-boundary bypass. Under-blocking lets internal targets be accessed, while over-blocking can block legitimate public addresses. Reachable targets include the entire `10.0.0.0/8` and `0.0.0.0/8` ranges. The issue affects all versions <= 10.3.0 and is critical for applications that rely on `ip-address` for network security decisions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
