GHSA-22jq-vg5j-6vgg: ip-address fixed in 10.2.1

GHSA-22jq-vg5j-6vgg PUBLISHED CVSS 6.900000095367432 MEDIUM

Record from GitHub Advisory Database · Published August 3, 2026

ip-address is fixed in 10.2.1 (npm)

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
ip-address	npm	10.2.1
unleash	Chainguard	8.0.3-r5
saf	Wolfi	1.7.0-r0
code-server	Chainguard	4.130.0-r6
wazuh-dashboard-fips	Chainguard	4.14.7-r6
kubeflow-pipelines	Chainguard	2.17.0-r3
graalvm-25	Chainguard	25.0.4-r15
langfuse-fips-4	Chainguard	4.4.0-r0
npm-12	Wolfi	12.0.2-r2
unleash-proxy	Chainguard	1.4.19-r7
prism	Wolfi	5.16.0-r4
librechat	Chainguard	0.8.7-r7

26 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0

6.900000095367432

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

Affected products

Vendor	Product	Versions
chainguard	unleash	0
wolfi	saf	0
chainguard	code-server	0
chainguard	wazuh-dashboard-fips	0
chainguard	kubeflow-pipelines	0
chainguard	graalvm-25	0
chainguard	langfuse-fips-4	0
wolfi	npm-12	0
chainguard	unleash-proxy	0
npm	ip-address
wolfi	prism	0
chainguard	librechat	0
chainguard	saf	0
chainguard	pulumi	0
chainguard	prism	0
chainguard	lerna	0
chainguard	unleash-fips	0
chainguard	wazuh-dashboard	0
chainguard	sqlpad	0
chainguard	opensearch-dashboards-2-fips	0

…and 19 more

Timeline

Aug 3, 2026 CVE Published
Aug 6, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-22jq-vg5j-6vgg
vulnetix vdb fixes GHSA-22jq-vg5j-6vgg

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-22jq-vg5j-6vgg/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →