CVE-2026-101910
MediumAdvisory
Published 28 Sept 2026In the index since 29 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 182
- of 17,939 indexed, latest versions
- Container images
- 160
- deployed by those charts
- Fix available
- 1 of 1
- affected package
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
Carried by container images the latest versions of 182 of 17,939 indexed charts deploy, on 160 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| ip-addressnpm | 10.2.0, 10.3.1, 10.4.0, 10.5.0 | 10.5.1 | 160 |
- OSV records
- GHSA-2vr4-cq9g-pvrc
Charts affected
182 by stars
Container images carrying it
160 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| growthbook/ | c8a124f55dca | ip-address | 10.5.1 | 1 |
| growthbook/ | cbf1bc59e9a9 | ip-address | 10.5.1 | 1 |
| haohanyang/ | f4f8fe4e21f1 | ip-address | 10.5.1 | 1 |
| helmforge/ | bf11156e0ab5 | ip-address | 10.5.1 | 1 |
| hoppscotch/ | e7ba6061a286 | ip-address | 10.5.1 | 1 |
| journeyapps/ | 413a0c813e96 | ip-address | 10.5.1 | 1 |
| kitware/ | da5abe941506 | ip-address | 10.5.1 | 1 |
| langflowai/ | 34055a07d446 | ip-address | 10.5.1 | 1 |
| langgenius/ | 8dd9de6b6190 | ip-address | 10.5.1 | 1 |
| langgenius/ | ba1dd1d0bcea | ip-address | 10.5.1 | 1 |
| library/ | 1ef2e532ca4d | ip-address | 10.5.1 | 1 |
| library/ | 29773d6be407 | ip-address | 10.5.1 | 1 |
| library/ | 77196da4b0df | ip-address | 10.5.1 | 1 |
| library/ | fa271c47a5d8 | ip-address | 10.5.1 | 1 |
| lissy93/ | 58a903b2cdd9 | ip-address | 10.5.1 | 1 |
| louislam/ | 91e963bfda56 | ip-address | 10.5.1 | 1 |
| luligu/ | e278cf685f91 | ip-address | 10.5.1 | 1 |
| mautic/ | eb8cc73d97e1 | ip-address | 10.5.1 | 1 |
| mcp/ | 5ffbf7f0a8aa | ip-address | 10.5.1 | 1 |
| mitre/ | 06f6e72d416a | ip-address | 10.5.1 | 1 |
| n8nio/ | 9f693fd55655 | ip-address | 10.5.1 | 1 |
| n8nio/ | cfe2704ff858 | ip-address | 10.5.1 | 1 |
| n8nio/ | fdce8f852ac7 | ip-address | 10.5.1 | 1 |
| neoskop/ | 15a480e34778 | ip-address | 10.5.1 | 1 |
| nodered/ | 10f40d0a83e7 | ip-address | 10.5.1 | 1 |
| nodered/ | d73ae167cb9b | ip-address | 10.5.1 | 1 |
| nousresearch/ | e0df6adebddf | ip-address | 10.5.1 | 1 |
| opencloudeu/ | 2beddf0cc6db | ip-address | 10.5.1 | 1 |
| otwld/ | 1c228d9ef71b | ip-address | 10.5.1 | 1 |
| outlinewiki/ | 832051f039b4 | ip-address | 10.5.1 | 1 |
| penpotapp/ | beb2c2bd9660 | ip-address | 10.5.1 | 1 |
| penpotapp/ | 9270da9fab95 | ip-address | 10.5.1 | 1 |
| requarks/ | af71a17dc27c | ip-address | 10.5.1 | 1 |
| rocketchat/ | 44af8ac4e711 | ip-address | 10.5.1 | 1 |
| rocketchat/ | 6bc18fb5d0e5 | ip-address | 10.5.1 | 1 |
| rocketchat/ | 819771c4abe4 | ip-address | 10.5.1 | 1 |
| rocketchat/ | c1170bdfe797 | ip-address | 10.5.1 | 1 |
| saidsef/ | 67025e3a163e | ip-address | 10.5.1 | 1 |
| shieldsio/ | f0fccbce3b75 | ip-address | 10.5.1 | 1 |
| sondresjo/ | 8bc03653f87e | ip-address | 10.5.1 | 1 |
| sondresjo/ | c4b8f096df6b | ip-address | 10.5.1 | 1 |
| sondresjo/ | b7cc8f543551 | ip-address | 10.5.1 | 1 |
| sondresjo/ | 706b0218f7b4 | ip-address | 10.5.1 | 1 |
| sondresjo/ | 4ce832347953 | ip-address | 10.5.1 | 1 |
| stnsmith/ | e448ab346cb3 | ip-address | 10.5.1 | 1 |
| supabase/ | 5fea789899d4 | ip-address | 10.5.1 | 1 |
| supabase/ | c8eb9858eafe | ip-address | 10.5.1 | 1 |
| swimmwatch/ | f6986203a121 | ip-address | 10.5.1 | 1 |
| tenureai/ | 5f5b222df9a5 | ip-address | 10.5.1 | 1 |
| trackerforce/ | 28ee0c4e0b88 | ip-address | 10.5.1 | 1 |