CVE-2026-101912
MediumAdvisory
Published 29 Sept 2026In the index since 30 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- 0.004
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 567
- of 17,957 indexed, latest versions
- Container images
- 573
- deployed by those charts
- Fix available
- 1 of 1
- affected package
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
Carried by container images the latest versions of 567 of 17,957 indexed charts deploy, on 573 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| ip-addressnpm | 5.9.4, 6.1.0, 6.4.0, 7.1.0+11 more | 10.7.1 | 573 |
- OSV records
- GHSA-j6r3-76f7-8jcv
- Trending
- Rank 24 in indexed charts, since 30 Sept 2026. See the ranking →
Charts affected
567 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| n8ncommunity-chartsVerified publisher | 1.24.42 | 1 of 1See more | 1,076 |
| n8nopen-8gears | 2.1.1 | 1 of 1See more | 1,441 |
| uptime-kumauptime-kumaVerified publisher | 4.2.0 | 1 of 1See more | 32,872 |
| backstagebackstageOfficialVerified publisher | 2.10.2 | 1 of 1See more | 1,179 |
| rocketchatrocketchat-server | 7.0.2 | 4 of 12See more | 12,965 |
| opensearch-dashboardsopensearch-project-helm-chartsVerified publisher | 3.9.0 | 1 of 1See more | 110 |
| penpotpenpotOfficialVerified publisher | 1.10.0 | 2 of 5See more | 5,731 |
| node-rednode-redVerified publisher | 0.40.2 | 1 of 1See more | 2,379 |
| mongo-expresscowboysysopVerified publisher | 7.0.0 | 1 of 1See more | 1,312 |
| difydoubanVerified publisher | 0.10.0 | 1 of 6See more | 81,789 |
| difydify-helmVerified publisher | 0.38.0 | 3 of 11See more | 71,885 |
| unleashunleash | 5.6.8 | 1 of 2See more | 1,977 |
| verdaccioverdaccio | 4.35.1 | 1 of 1See more | 303 |
| apisix-ingress-controllerapisix | 1.4.0 | 1 of 2See more | 1,934 |
| actualbudgetcommunity-chartsVerified publisher | 1.9.4 | 1 of 1See more | 1,303 |
| openprojectopenproject-helm-chartsOfficialVerified publisher | 13.12.0 | 1 of 5See more | 21,702 |
| wazuhwazuh-helm-morgovedVerified publisher | 2.0.7 | 1 of 5See more | 12,133 |
| lemmyananace-chartsVerified publisher | 0.6.15 | 1 of 5See more | 7,734 |
| chatwootchatwootVerified publisher | 2.0.27 | 1 of 3See more | 6,062 |
| stacks-blockchain-apihirosystemsVerified publisher | 6.5.1 | 1 of 5See more | 8,376 |
| homarrhomarr-labsOfficialVerified publisher | 8.29.2 | 1 of 1See more | 614 |
| localstacklocalstack | 0.7.1 | 1 of 1See more | 2,438 |
| oneuptimeoneuptimeOfficialVerified publisher | 14.0.9 | 1 of 7See more | 8,770 |
| openclawopenclaw-helmVerified publisher | 1.5.40 | 1 of 2See more | 6,318 |
| outlinekubitodevVerified publisher | 1.2.2 | 1 of 4See more | 5,826 |
| servarrkubitodevVerified publisher | 1.5.2 | 1 of 10See more | 3,321 |
| velero-uiotwldVerified publisher | 0.16.0 | 1 of 1See more | 1,552 |
| supabasetokens-studioVerified publisher | 1.0.0 | 3 of 14See more | 24,354 |
| budibasebudibase | 0.0.0-master | 3 of 7See more | 11,186 |
| krokicowboysysopVerified publisher | 6.1.0 | 4 of 5See more | 7,856 |
| homepagem0nsterrr-homepageVerified publisher | 5.4.0 | 1 of 1See more | 537 |
| n8nn8n | 0.23.0 | 1 of 1See more | 6,067 |
| openclawopenclawVerified publisher | 1.94.0 | 2 of 2See more | 3,842 |
| hedgedocadfinisVerified publisher | 0.6.1 | 1 of 2See more | 3,434 |
| zigbee2mqttandrenarchyVerified publisher | 9.44.0 | 1 of 1See more | 247 |
| umamichristianhuthVerified publisher | 7.14.1 | 1 of 2See more | 2,453 |
| n8nhelmforgeVerified publisher | 2.1.2 | 1 of 2See more | 1,114 |
| ilumilumOfficialVerified publisher | 6.7.3 | 1 of 19See more | 23,726 |
| syftopenmined | 0.9.5 | 1 of 6See more | 18,071 |
| zigbee2mqttzigbee2mqtt | 2.14.1 | 1 of 2See more | 1,275 |
| docmosthelmforgeVerified publisher | 1.4.0 | 1 of 4See more | 3,937 |
| redisinsightredisinsight-guiVerified publisher | 1.3.5 | 1 of 1See more | 1,223 |
| redisinsight-secureredisinsight-secureVerified publisher | 1.0.2 | 1 of 1See more | 1,915 |
| backstagerhdh-chartVerified publisher | 4.0.1 | 1 of 2See more | 1,112 |
| wazuhwazuh-helmVerified publisher | 0.0.8 | 1 of 4See more | 6,599 |
| misskeyalytiVerified publisher | 1.0.0 | 1 of 1See more | 5,489 |
| kuttchristianhuthVerified publisher | 9.11.2 | 1 of 3See more | 614 |
| dialdialOfficialVerified publisher | 8.0.0 | 1 of 4See more | 2,203 |
| foundry-vttfoundry-vttVerified publisher | 12.343.0 | 1 of 1See more | 811 |
| wikijsgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 6,156 |
Container images carrying it
573 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| koenkk/ | fef0de769dcd | ip-address | 10.7.1 | 5 |
| decisionrules/ | 6a8f32aa11bc | ip-address | 10.7.1 | 4 |
| redis/ | b5e19ee240ab | ip-address | 10.7.1 | 4 |
| joplin/ | 3f7b852959aa | ip-address | 10.7.1 | 3 |
| library/ | 64af3819f927 | ip-address | 10.7.1 | 3 |
| library/ | ebfe2f904627 | ip-address | 10.7.1 | 3 |
| localstack/ | 4abc29e923e5 | ip-address | 10.7.1 | 3 |
| opensearchproject/ | 4bdb8ded547c | ip-address | 10.7.1 | 3 |
| verdaccio/ | 09b403888c8f | ip-address | 10.7.1 | 3 |
| ghcr.io/ | f65f53dd9668 | ip-address | 10.7.1 | 3 |
| ghcr.io/ | f0fb462299af | ip-address | 10.7.1 | 3 |
| ghcr.io/ | 3cc10a496ced | ip-address | 10.7.1 | 3 |
| quay.io/ | 709c7da19c5a | ip-address | 10.7.1 | 3 |
| quay.io/ | 89bd85d7817f | ip-address | 10.7.1 | 3 |
| actualbudget/ | 552beab3dec8 | ip-address | 10.7.1 | 2 |
| epamedp/ | 687acf641097 | ip-address | 10.7.1 | 2 |
| homebridge/ | 77c685a40911 | ip-address | 10.7.1 | 2 |
| hoppscotch/ | f1da831950b7 | ip-address | 10.7.1 | 2 |
| ilum/ | 998937726679 | ip-address | 10.7.1 | 2 |
| kutt/ | fa3d24a89b04 | ip-address | 10.7.1 | 2 |
| langflowai/ | 79c02794adeb | ip-address | 10.7.1 | 2 |
| library/ | 90592b712b6b | ip-address | 10.7.1 | 2 |
| library/ | 1b23d7976f02 | ip-address | 10.7.1 | 2 |
| library/ | 9ec4a2e28987 | ip-address | 10.7.1 | 2 |
| louislam/ | 917318f9d7be | ip-address | 10.7.1 | 2 |
| louislam/ | 96510915e6be | ip-address | 10.7.1 | 2 |
| louislam/ | 9aeb4e51d038 | ip-address | 10.7.1 | 2 |
| louislam/ | a8610b3b4c38 | ip-address | 10.7.1 | 2 |
| louislam/ | c74379ac4509 | ip-address | 10.7.1 | 2 |
| mojaloop/ | d480a62103d6 | ip-address | 10.7.1 | 2 |
| mojaloop/ | 2635baf23298 | ip-address | 10.7.1 | 2 |
| mojaloop/ | 1e0d24d28512 | ip-address | 10.7.1 | 2 |
| mojaloop/ | b45a2d6f0f2a | ip-address | 10.7.1 | 2 |
| mojaloop/ | 265102a049d6 | ip-address | 10.7.1 | 2 |
| mojaloop/ | 12af60892c75 | ip-address | 10.7.1 | 2 |
| n8nio/ | 14c4285bc303 | ip-address | 10.7.1 | 2 |
| nodered/ | a649dd711d55 | ip-address | 10.7.1 | 2 |
| nousresearch/ | fca358f12efd | ip-address | 10.7.1 | 2 |
| opensearchproject/ | 39695180364b | ip-address | 10.7.1 | 2 |
| patrikx3/ | f19eb45b0694 | ip-address | 10.7.1 | 2 |
| rajnandan1/ | 30407afca731 | ip-address | 10.7.1 | 2 |
| redis/ | 1c5f43fddcdd | ip-address | 10.7.1 | 2 |
| requarks/ | 68f0d1848261 | ip-address | 10.7.1 | 2 |
| siscc/ | 12c5048f7402 | ip-address | 10.7.1 | 2 |
| speckle/ | 4bd113093583 | ip-address | 10.7.1 | 2 |
| sysnet4admin/ | c5bd3bb1b5a6 | ip-address | 10.7.1 | 2 |
| taskrabbit/ | c967fe68b9c7 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 180acad33d69 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 6432d1dc5895 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | b1ba7b054af2 | ip-address | 10.7.1 | 2 |