Medium severity6.1GHSA Advisory· Published May 12, 2026· Updated Aug 10, 2026
CVE-2026-42338
CVE-2026-42338
Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ip-addressnpm | < 10.1.1 | 10.1.1 |
Affected products
111<= 10.1.0+ 1 more
- (no CPE)range: <= 10.1.0
- cpe:2.3:a:beaugunderson:ip-address:*:*:*:*:*:node.js:*:*range: <10.1.1
- osv-coords109 versionspkg:apk/chainguard/actions-runnerpkg:apk/chainguard/code-serverpkg:apk/chainguard/drupal-11.3pkg:apk/chainguard/gemini-clipkg:apk/chainguard/graalvm-25-ce-nodejspkg:apk/chainguard/katib-earlystoppingpkg:apk/chainguard/katib-suggestion-hyperbandpkg:apk/chainguard/katib-suggestion-hyperoptpkg:apk/chainguard/katib-suggestion-nas-dartspkg:apk/chainguard/katib-suggestion-nas-enaspkg:apk/chainguard/katib-suggestion-optuna-enaspkg:apk/chainguard/katib-suggestion-pbt-enaspkg:apk/chainguard/katib-suggestion-skopt-enaspkg:apk/chainguard/katib-tfevent-metricscollectorpkg:apk/chainguard/kibana-8.17pkg:apk/chainguard/kibana-8.17-bitnamipkg:apk/chainguard/kibana-8.17-iamguardedpkg:apk/chainguard/kibana-8.19pkg:apk/chainguard/kibana-8.19-bitnamipkg:apk/chainguard/kibana-8.19-iamguardedpkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kibana-9.1pkg:apk/chainguard/kibana-9.1-iamguardedpkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/kibana-9.3pkg:apk/chainguard/kibana-9.3-iamguardedpkg:apk/chainguard/kibana-9.4pkg:apk/chainguard/kibana-9.4-iamguardedpkg:apk/chainguard/kubeflow-pipelines-frontendpkg:apk/chainguard/langfuse-2pkg:apk/chainguard/langfuse-2-workerpkg:apk/chainguard/langfuse-3pkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-fips-2pkg:apk/chainguard/langfuse-fips-2-workerpkg:apk/chainguard/langfuse-fips-3pkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/lernapkg:apk/chainguard/librechatpkg:apk/chainguard/npmpkg:apk/chainguard/opensearch-dashboards-2pkg:apk/chainguard/opensearch-dashboards-2-fipspkg:apk/chainguard/opensearch-dashboards-2-fips-security-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-2-security-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3pkg:apk/chainguard/opensearch-dashboards-3-fipspkg:apk/chainguard/opensearch-dashboards-3-fips-security-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-security-dashboards-pluginpkg:apk/chainguard/prismpkg:apk/chainguard/pulumi-language-nodejspkg:apk/chainguard/renovatepkg:apk/chainguard/safpkg:apk/chainguard/sqlpadpkg:apk/chainguard/tileserver-glpkg:apk/chainguard/tileserver-gl-fipspkg:apk/chainguard/wazuh-dashboardpkg:apk/chainguard/wazuh-dashboard-fipspkg:apk/chainguard/wazuh-dashboard-security-pluginpkg:apk/chainguard/wazuh-dashboard-security-plugin-fipspkg:apk/wolfi/code-serverpkg:apk/wolfi/katib-earlystoppingpkg:apk/wolfi/katib-suggestion-hyperbandpkg:apk/wolfi/katib-suggestion-hyperoptpkg:apk/wolfi/katib-suggestion-nas-dartspkg:apk/wolfi/katib-suggestion-nas-enaspkg:apk/wolfi/katib-suggestion-optuna-enaspkg:apk/wolfi/katib-suggestion-pbt-enaspkg:apk/wolfi/katib-suggestion-skopt-enaspkg:apk/wolfi/katib-tfevent-metricscollectorpkg:apk/wolfi/kubeflow-pipelines-frontendpkg:apk/wolfi/langfuse-3pkg:apk/wolfi/langfuse-3-workerpkg:apk/wolfi/lernapkg:apk/wolfi/npmpkg:apk/wolfi/opensearch-dashboards-2pkg:apk/wolfi/opensearch-dashboards-2-security-dashboards-pluginpkg:apk/wolfi/opensearch-dashboards-3pkg:apk/wolfi/opensearch-dashboards-3-security-dashboards-pluginpkg:apk/wolfi/prismpkg:apk/wolfi/pulumi-language-nodejspkg:apk/wolfi/renovatepkg:apk/wolfi/safpkg:apk/wolfi/sqlpadpkg:apk/wolfi/tileserver-glpkg:npm/ip-addresspkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/v8-13.6-develpkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweed
< 2.334.0-r1+ 108 more
- (no CPE)range: < 2.334.0-r1
- (no CPE)range: < 4.112.0-r4
- (no CPE)range: < 11.3.13-r3
- (no CPE)range: < 0.41.2-r0
- (no CPE)range: < 25.0.4-r2
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 8.17.10-r21
- (no CPE)range: < 8.17.10-r21
- (no CPE)range: < 8.17.10-r21
- (no CPE)range: < 8.19.15-r0
- (no CPE)range: < 8.19.15-r0
- (no CPE)range: < 8.19.15-r0
- (no CPE)range: < 9.0.8-r25
- (no CPE)range: < 9.0.8-r25
- (no CPE)range: < 9.0.8-r25
- (no CPE)range: < 9.1.10-r17
- (no CPE)range: < 9.1.10-r17
- (no CPE)range: < 9.2.8-r3
- (no CPE)range: < 9.2.8-r3
- (no CPE)range: < 9.3.4-r4
- (no CPE)range: < 9.3.4-r4
- (no CPE)range: < 9.4.2-r0
- (no CPE)range: < 9.4.2-r0
- (no CPE)range: < 2.16.1-r1
- (no CPE)range: < 2.95.12-r23
- (no CPE)range: < 2.95.12-r23
- (no CPE)range: < 3.174.1-r0
- (no CPE)range: < 3.174.1-r0
- (no CPE)range: < 2.95.12-r25
- (no CPE)range: < 2.95.12-r25
- (no CPE)range: < 3.174.1-r0
- (no CPE)range: < 3.174.1-r0
- (no CPE)range: < 9.0.7-r4
- (no CPE)range: < 0.8.4-r6
- (no CPE)range: < 11.14.0-r0
- (no CPE)range: < 2.19.5-r11
- (no CPE)range: < 2.19.5-r11
- (no CPE)range: < 2.19.5-r11
- (no CPE)range: < 2.19.5-r11
- (no CPE)range: < 3.6.0-r3
- (no CPE)range: < 3.6.0-r5
- (no CPE)range: < 3.6.0-r5
- (no CPE)range: < 3.6.0-r3
- (no CPE)range: < 5.15.10-r0
- (no CPE)range: < 3.237.0-r1
- (no CPE)range: < 43.170.15-r2
- (no CPE)range: < 1.6.0-r0
- (no CPE)range: < 7.5.7-r20
- (no CPE)range: < 5.6.0-r2
- (no CPE)range: < 5.6.0-r2
- (no CPE)range: < 4.14.4-r4
- (no CPE)range: < 4.14.4-r3
- (no CPE)range: < 4.14.4-r4
- (no CPE)range: < 4.14.4-r3
- (no CPE)range: < 4.112.0-r4
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 2.16.1-r1
- (no CPE)range: < 3.174.1-r0
- (no CPE)range: < 3.174.1-r0
- (no CPE)range: < 9.0.7-r4
- (no CPE)range: < 11.14.0-r0
- (no CPE)range: < 2.19.5-r11
- (no CPE)range: < 2.19.5-r11
- (no CPE)range: < 3.6.0-r3
- (no CPE)range: < 3.6.0-r3
- (no CPE)range: < 5.15.10-r0
- (no CPE)range: < 3.237.0-r1
- (no CPE)range: < 43.170.15-r2
- (no CPE)range: < 1.6.0-r0
- (no CPE)range: < 7.5.7-r20
- (no CPE)range: < 5.6.0-r2
- (no CPE)range: < 10.1.1
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 1:22.23.1-2.el10_2
- (no CPE)range: < 3.0.3-3.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:10.9.8-1.22.23.1.2.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:24.18.0-1.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
- (no CPE)range: < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
- (no CPE)range: < 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
- (no CPE)range: < 22.23.0-160000.1.1
- (no CPE)range: < 24.18.0-160000.1.1
- (no CPE)range: < 24.17.0-1.1
Patches
Vulnerability mechanics
References
28- github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8gnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-v2v4-37r5-5v8gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-42338ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:33155nvd
- access.redhat.com/errata/RHSA-2026:33160nvd
- access.redhat.com/errata/RHSA-2026:33163nvd
- access.redhat.com/errata/RHSA-2026:33173nvd
- access.redhat.com/errata/RHSA-2026:33183nvd
- access.redhat.com/errata/RHSA-2026:33574nvd
- access.redhat.com/errata/RHSA-2026:34374nvd
- access.redhat.com/errata/RHSA-2026:35841nvd
- access.redhat.com/errata/RHSA-2026:35842nvd
- access.redhat.com/errata/RHSA-2026:35891nvd
- access.redhat.com/errata/RHSA-2026:35892nvd
- access.redhat.com/errata/RHSA-2026:36754nvd
- access.redhat.com/errata/RHSA-2026:36820nvd
- access.redhat.com/errata/RHSA-2026:39246nvd
- access.redhat.com/errata/RHSA-2026:39868nvd
- access.redhat.com/errata/RHSA-2026:41928nvd
- access.redhat.com/errata/RHSA-2026:41947nvd
- access.redhat.com/errata/RHSA-2026:44237nvd
- access.redhat.com/errata/RHSA-2026:44263nvd
- access.redhat.com/errata/RHSA-2026:44267nvd
- access.redhat.com/errata/RHSA-2026:51200nvd
- access.redhat.com/errata/RHSA-2026:52399nvd
- access.redhat.com/security/cve/CVE-2026-42338nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42338.jsonnvd
News mentions
0No linked articles in our index yet.