CVE-2026-42338

Medium

Description

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

SeverityMedium

CVSS6.1

Exploit probability—

ProductBeaugunderson Ip-address

PublishedMay 12, 2026

First seenMay 12, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

beaugunderson ip-address10.1.1 or later
ip-address10.1.1 or later

Vendor advisories

Affected products

Product	Affected versions	Fixed in
beaugunderson ip-address	v < 10.1.1	10.1.1
ip-addressnpm	v < 10.1.1	10.1.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.