{ "@id": "urn:uuid:dfbc7562-bdd6-45cf-aa13-8268aa5ad800", "role": "Document Creator", "author": "https://tuxcare.com", "version": 9, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:22:35.506021+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-10-15T12:05:31.691380+00:00", "status_notes": "Vulnerability CVE-2026-101910 affects version 10.4.0 of ip-address.", "vulnerability": { "name": "CVE-2026-101910" }, "action_statement": "Vulnerability CVE-2026-101910 affects version 10.4.0 of ip-address." }, { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability CVE-2026-101911 affects version 10.4.0 of ip-address.", "vulnerability": { "name": "CVE-2026-101911" }, "action_statement": "Vulnerability CVE-2026-101911 affects version 10.4.0 of ip-address." }, { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability CVE-2026-101912 affects version 10.4.0 of ip-address.", "vulnerability": { "name": "CVE-2026-101912" }, "action_statement": "Vulnerability CVE-2026-101912 affects version 10.4.0 of ip-address." }, { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-10-15T12:05:31.691380+00:00", "status_notes": "Vulnerability CVE-2026-101913 affects version 10.4.0 of ip-address.", "vulnerability": { "name": "CVE-2026-101913" }, "action_statement": "Vulnerability CVE-2026-101913 affects version 10.4.0 of ip-address." }, { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-10-18T00:49:00.202423+00:00", "status_notes": "Vulnerability CVE-2026-111997 affects version 10.4.0 of ip-address.", "vulnerability": { "name": "CVE-2026-111997" }, "action_statement": "Vulnerability CVE-2026-111997 affects version 10.4.0 of ip-address." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-11-13T22:49:00.060071+00:00", "status_notes": "Vulnerability CVE-2026-42338 does not affect version 10.4.0 of ip-address. not_affected \u2014 The target (ip-address 10.4.0) already contains the upstream fix for CVE-2026-42338 (upstream commit d98f88c, shipped in 10.1.1). group(), link(), spanAll() and the leading-zero IPv4 parseMessage path all HTML-escape attacker-controlled text. The bad-character and bad-address parseMessage branches wrap every non-[0-9a-f:/%] character in its own span, so the remaining text cannot form markup.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42338" }, "impact_statement": "not_affected \u2014 The target (ip-address 10.4.0) already contains the upstream fix for CVE-2026-42338 (upstream commit d98f88c, shipped in 10.1.1). group(), link(), spanAll() and the leading-zero IPv4 parseMessage path all HTML-escape attacker-controlled text. The bad-character and bad-address parseMessage branches wrap every non-[0-9a-f:/%] character in its own span, so the remaining text cannot form markup." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-11-13T23:22:35.506021+00:00", "status_notes": "Vulnerability CVE-2026-54272 does not affect version 10.4.0 of ip-address. not_affected \u2014 Target ip-address 10.4.0 already contains the upstream fix for CVE-2026-54272. Address6 has embeddedIPv4(), which normalizes IPv4-mapped and NAT64 well-known addresses to Address4. isLoopback, isLinkLocal, isMulticast and isUnspecified consult it first. isPrivate, isCGNAT and isBroadcast exist, and getType() labels ::ffff:0:0/96 as 'IPv4-mapped'. The fix is upstream commit 4a1f613 (author beau....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54272" }, "impact_statement": "not_affected \u2014 Target ip-address 10.4.0 already contains the upstream fix for CVE-2026-54272. Address6 has embeddedIPv4(), which normalizes IPv4-mapped and NAT64 well-known addresses to Address4. isLoopback, isLinkLocal, isMulticast and isUnspecified consult it first. isPrivate, isCGNAT and isBroadcast exist, and getType() labels ::ffff:0:0/96 as 'IPv4-mapped'. The fix is upstream commit 4a1f613 (author beau...." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-11-13T23:08:06.796827+00:00", "status_notes": "Vulnerability CVE-2026-69192 does not affect version 10.4.0 of ip-address. not_affected \u2014 Target ip-address 10.4.0 already contains the upstream fix (beaugunderson commit 56368cb, GHSA-mwp4-54f8-5fhr, shipped in 10.3.1). Address4.parse rejects any octet with a leading zero followed by digits, and RE_ADDRESS no longer accepts zero-padded octets. The fix is upstream-authored and part of the upstream release, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69192" }, "impact_statement": "not_affected \u2014 Target ip-address 10.4.0 already contains the upstream fix (beaugunderson commit 56368cb, GHSA-mwp4-54f8-5fhr, shipped in 10.3.1). Address4.parse rejects any octet with a leading zero followed by digits, and RE_ADDRESS no longer accepts zero-padded octets. The fix is upstream-authored and part of the upstream release, so it is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-11-13T23:13:21.676667+00:00", "status_notes": "Vulnerability CVE-2026-69198 does not affect version 10.4.0 of ip-address. not_affected \u2014 ip-address 10.4.0 already contains the upstream fix for CVE-2026-69198 (upstream commit 488fe9bc). All special-use classifiers use the new isHostInSubnet(), which ignores the address's own CIDR suffix. isInSubnet keeps its containment guard but is no longer used for classification. The fix shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69198" }, "impact_statement": "not_affected \u2014 ip-address 10.4.0 already contains the upstream fix for CVE-2026-69198 (upstream commit 488fe9bc). All special-use classifiers use the new isHostInSubnet(), which ignores the address's own CIDR suffix. isInSubnet keeps its containment guard but is no longer used for classification. The fix shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.4.0", "identifiers": { "purl": "pkg:npm/ip-address@10.4.0" } } ], "timestamp": "2026-10-22T17:10:00.682732+00:00", "status_notes": "Vulnerability GHSA-p3hm-x653-5rc6 is a false positive for ip-address 10.4.0.", "vulnerability": { "name": "GHSA-p3hm-x653-5rc6" }, "impact_statement": "The vulnerability has been withdrawn." } ] }