ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade v8-12.4-develUpgrade nodejs-devel | Jul 7, 2026 | Jul 6, 2026 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs24-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs24Upgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs-libs-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs-docsUpgrade rh-podman-desktopUpgrade v8-12.4-develUpgrade nodejs24-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs-packagingUpgrade nodejs24-full-i18nUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-npmUpgrade nodejs24-libsUpgrade nodejs24-docsUpgrade npmUpgrade nodejs-nodemon | Jul 7, 2026 | May 12, 2026 |
| Rocky_linux | — | Upgrade nodejs24-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs24-develUpgrade nodejs-debuginfoUpgrade v8-12.4-develUpgrade nodejs24Upgrade npmUpgrade nodejs22-debuginfoUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs22-debugsourceUpgrade nodejs-libsUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs24-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs24-libsUpgrade nodejs-libs-debuginfo | Jul 10, 2026 | Jul 7, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub