{ "@id": "urn:uuid:04533fe4-e1db-488f-ab1f-5ede2ec41786", "role": "Document Creator", "author": "https://tuxcare.com", "version": 8, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:22:35.506021+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-11-03T17:03:25.795966+00:00", "status_notes": "Vulnerability CVE-2026-101910 affects version 10.6.0 of ip-address.", "vulnerability": { "name": "CVE-2026-101910" }, "action_statement": "Vulnerability CVE-2026-101910 affects version 10.6.0 of ip-address." }, { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability CVE-2026-101911 affects version 10.6.0 of ip-address.", "vulnerability": { "name": "CVE-2026-101911" }, "action_statement": "Vulnerability CVE-2026-101911 affects version 10.6.0 of ip-address." }, { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability CVE-2026-101912 affects version 10.6.0 of ip-address.", "vulnerability": { "name": "CVE-2026-101912" }, "action_statement": "Vulnerability CVE-2026-101912 affects version 10.6.0 of ip-address." }, { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-11-03T17:03:25.795966+00:00", "status_notes": "Vulnerability CVE-2026-101913 affects version 10.6.0 of ip-address.", "vulnerability": { "name": "CVE-2026-101913" }, "action_statement": "Vulnerability CVE-2026-101913 affects version 10.6.0 of ip-address." }, { "status": "affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-10-18T00:49:00.202423+00:00", "status_notes": "Vulnerability CVE-2026-111997 affects version 10.6.0 of ip-address.", "vulnerability": { "name": "CVE-2026-111997" }, "action_statement": "Vulnerability CVE-2026-111997 affects version 10.6.0 of ip-address." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-11-13T22:45:11.501462+00:00", "status_notes": "Vulnerability CVE-2026-42338 does not affect version 10.6.0 of ip-address. not_affected \u2014 Target is ip-address 10.6.0. The upstream fix for CVE-2026-42338 (d98f88cf, \"Merge commit from fork\") is an ancestor of HEAD, so the code is not vulnerable. Address6.group(), link(), the leading-zero IPv4 error parseMessage and spanAll() all HTML-escape attacker-controlled content. The fix shipped in the upstream release and the only TuxCare-style commit is a tuxcare.yaml build config.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42338" }, "impact_statement": "not_affected \u2014 Target is ip-address 10.6.0. The upstream fix for CVE-2026-42338 (d98f88cf, \"Merge commit from fork\") is an ancestor of HEAD, so the code is not vulnerable. Address6.group(), link(), the leading-zero IPv4 error parseMessage and spanAll() all HTML-escape attacker-controlled content. The fix shipped in the upstream release and the only TuxCare-style commit is a tuxcare.yaml build config." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-11-13T23:22:35.506021+00:00", "status_notes": "Vulnerability CVE-2026-54272 does not affect version 10.6.0 of ip-address. not_affected \u2014 The target (ip-address 10.6.0) already contains the upstream fix for CVE-2026-54272. Address6 normalizes IPv4-mapped and NAT64 well-known addresses to the embedded IPv4 before classifying. The fix is upstream commit 4a1f613 (author beau.gunderson@canvasmedical.com), which is in the 10.6.0 release and an ancestor of HEAD. HEAD's only non-upstream commit is a tuxcare.yaml build-config commit, so ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54272" }, "impact_statement": "not_affected \u2014 The target (ip-address 10.6.0) already contains the upstream fix for CVE-2026-54272. Address6 normalizes IPv4-mapped and NAT64 well-known addresses to the embedded IPv4 before classifying. The fix is upstream commit 4a1f613 (author beau.gunderson@canvasmedical.com), which is in the 10.6.0 release and an ancestor of HEAD. HEAD's only non-upstream commit is a tuxcare.yaml build-config commit, so ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-11-13T23:05:15.656839+00:00", "status_notes": "Vulnerability CVE-2026-69192 does not affect version 10.6.0 of ip-address. not_affected \u2014 ip-address 10.6.0 already contains the upstream fix for the Address4 leading-zero octet parsing flaw (CVE-2026-69192). The fix is upstream commit 56368cb by beau@beaugunderson.com, which shipped inside the upstream release. Address4.parse rejects leading-zero octets, and RE_ADDRESS no longer matches them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69192" }, "impact_statement": "not_affected \u2014 ip-address 10.6.0 already contains the upstream fix for the Address4 leading-zero octet parsing flaw (CVE-2026-69192). The fix is upstream commit 56368cb by beau@beaugunderson.com, which shipped inside the upstream release. Address4.parse rejects leading-zero octets, and RE_ADDRESS no longer matches them." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-11-13T23:20:15.981337+00:00", "status_notes": "Vulnerability CVE-2026-69198 does not affect version 10.6.0 of ip-address. not_affected \u2014 ip-address 10.6.0 already contains the upstream fix for CVE-2026-69198. Upstream commit 488fe9b (\"Merge commit from fork\") adds isHostInSubnet, and every special-use classifier now uses it. The classifiers therefore ignore the address's own CIDR suffix. isInSubnet keeps its containment guard, but classification no longer calls it. The fix was authored upstream by beau@beaugunderson.com and is i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69198" }, "impact_statement": "not_affected \u2014 ip-address 10.6.0 already contains the upstream fix for CVE-2026-69198. Upstream commit 488fe9b (\"Merge commit from fork\") adds isHostInSubnet, and every special-use classifier now uses it. The classifiers therefore ignore the address's own CIDR suffix. isInSubnet keeps its containment guard, but classification no longer calls it. The fix was authored upstream by beau@beaugunderson.com and is i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/ip-address@10.6.0", "identifiers": { "purl": "pkg:npm/ip-address@10.6.0" } } ], "timestamp": "2026-10-22T17:10:00.682732+00:00", "status_notes": "Vulnerability GHSA-p3hm-x653-5rc6 is a false positive for ip-address 10.6.0.", "vulnerability": { "name": "GHSA-p3hm-x653-5rc6" }, "impact_statement": "The vulnerability has been withdrawn." } ] }