CVE-2026-101912
MediumAdvisory
Published 29 Sept 2026In the index since 30 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- 0.004
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 567
- of 17,957 indexed, latest versions
- Container images
- 573
- deployed by those charts
- Fix available
- 1 of 1
- affected package
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
Carried by container images the latest versions of 567 of 17,957 indexed charts deploy, on 573 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| ip-addressnpm | 5.9.4, 6.1.0, 6.4.0, 7.1.0+11 more | 10.7.1 | 573 |
- OSV records
- GHSA-j6r3-76f7-8jcv
- Trending
- Rank 24 in indexed charts, since 30 Sept 2026. See the ranking →
Charts affected
567 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| heimdallheimdallOfficialVerified publisher | 3.3.3 | 1 of 2See more | 2,154 |
| karakeephelmforgeVerified publisher | 1.2.9 | 2 of 3See more | 10,952 |
| openctihelm-openctiVerified publisher | 3.0.13 | 1 of 8See more | 3,397 |
| kubernetes-loggingkubernetes-logging | 4.8.0 | 1 of 6See more | 11,206 |
| librechatlibrechat | 1.8.10 | 1 of 3See more | 3,061 |
| libredb-studiolibredb-studioVerified publisher | 0.1.72 | 1 of 1See more | 1,172 |
| headplanenbcloudVerified publisher | 0.1.2 | 1 of 4See more | 8,661 |
| wg-easywg-easyVerified publisher | 0.1.6 | 1 of 1See more | 848 |
| ghostcloudpirates-ghostVerified publisher | 0.20.26 | 1 of 3See more | 7,632 |
| codetogethercodetogether | 1.4.25 | 1 of 1See more | 7,779 |
| foremancontane-githubOfficialVerified publisher | 0.6.0 | 1 of 1See more | 1,432 |
| convertigoconvertigoOfficialVerified publisher | 8.4.5 | 1 of 5See more | 15,947 |
| cosmocosmo-platformOfficialVerified publisher | 0.20.0 | 3 of 10See more | 31,135 |
| hoppscotchdeliveryheroVerified publisher | 0.3.2 | 1 of 1See more | 3,663 |
| duplistatusduplistatusVerified publisher | 1.3.0 | 1 of 2See more | 961 |
| rsshubgabe565Verified publisher | 0.8.0 | 1 of 3See more | 1,739 |
| ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher | 1.1.2 | 1 of 3See more | 1,739 |
| hermes-agenthermes-agentVerified publisher | 1.16.0 | 1 of 1See more | 6,076 |
| home-assistanthome-assistantVerified publisher | 0.5.11 | 1 of 3See more | 2,729 |
| coreinstill-aiOfficialVerified publisher | 0.1.75 | 1 of 15See more | 32,513 |
| dynamodbkeyporttech | 0.1.27 | 1 of 2See more | 1,425 |
| kubebadgeskubebadges | 0.1.3 | 1 of 2See more | 1,675 |
| activepiecesmeyerchartsVerified publisher | 0.1.6 | 1 of 1See more | 3,078 |
| pacmanpacmanVerified publisher | 2.0.2 | 1 of 2See more | 729 |
| overseerrpree-helm-chartsVerified publisher | 1.2.0 | 1 of 1See more | 2,915 |
| hedgedocrobertobochetVerified publisher | 1.4.0 | 1 of 1See more | 1,242 |
| pretixtechwolf12Verified publisher | 2026.7.0 | 1 of 3See more | 11,021 |
| feedbacksystemthm-mni-iiVerified publisher | 0.48.0 | 3 of 14See more | 25,836 |
| wgerwgerOfficialVerified publisher | 2.0.0 | 1 of 7See more | 8,041 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 4,582 |
| aapbaapbVerified publisher | 0.1.3 | 1 of 1See more | 1,234 |
| agentareaagentareaVerified publisher | 0.0.25 | 2 of 17See more | 12,181 |
| hermes-agentankra-chartsVerified publisher | 0.3.1 | 1 of 1See more | 6,793 |
| dbgateappscodeVerified publisher | 2026.3.30 | 1 of 1See more | 693 |
| kinesisaws-kinesis-local | 0.8.0 | 1 of 1See more | 484 |
| seerrbdclark-helm-chartsVerified publisher | 0.1.5 | 1 of 1See more | 2,303 |
| opensearch-dashboardscaptnbpVerified publisher | 2.2.1 | 1 of 1See more | 1,977 |
| home-assistant-matter-servercharts-derwitt-devVerified publisher | 4.2.1 | 1 of 2See more | 2,726 |
| node-redcharts-derwitt-devVerified publisher | 2.1.2 | 1 of 1See more | 245 |
| maildevchristianhuthVerified publisher | 1.6.0 | 1 of 1See more | 1,451 |
| claude-code-hubclaude-code-hub | 0.1.0 | 1 of 4See more | 2,200 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 2 of 12See more | 40,129 |
| kubedashdevopstalesOfficialVerified publisher | 4.0.0 | 1 of 8See more | 10,013 |
| directusdirectus-io | 2.1.0 | 1 of 3See more | 8,280 |
| jellystatdjjudas21Verified publisher | 1.0.1 | 1 of 1See more | 1,826 |
| joplin-serverdjjudas21Verified publisher | 6.0.0 | 1 of 1See more | 2,858 |
| domain-lockerdomain-locker | 0.3.1 | 1 of 2See more | 758 |
| rstudiodsri-helm-charts | 0.1.28 | 1 of 1See more | 75,874 |
| enbuildenbuildVerified publisher | 0.0.50 | 3 of 6See more | 33,660 |
| ethereumjsethereum-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 1,728 |
Container images carrying it
573 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 82d0b161161d | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 81afafdd96a5 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 643bd0be730d | ip-address | 10.7.1 | 2 |
| ghcr.io/ | b434cb9287ee | ip-address | 10.7.1 | 2 |
| ghcr.io/ | ce4d58724e25 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 7e2ef5261764 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | ca31ec35b829 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | f4768de5f616 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 0e7bc9d34e86 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 5f26407fd2ed | ip-address | 10.7.1 | 2 |
| aaronshaf/ | ac41724cd997 | ip-address | 10.7.1 | 1 |
| activepieces/ | 58414dfc94c4 | ip-address | 10.7.1 | 1 |
| activepieces/ | a12efde0c535 | ip-address | 10.7.1 | 1 |
| activepieces/ | c26188b44e62 | ip-address | 10.7.1 | 1 |
| actualbudget/ | 58fecd9088b7 | ip-address | 10.7.1 | 1 |
| adeptiainc/ | 283001e83739 | ip-address | 10.7.1 | 1 |
| adeptiainc/ | 31f295e948e6 | ip-address | 10.7.1 | 1 |
| agentarea/ | cc575d17d174 | ip-address | 10.7.1 | 1 |
| agentarea/ | be4a11f799b2 | ip-address | 10.7.1 | 1 |
| akeyless/ | d4768a9b089c | ip-address | 10.7.1 | 1 |
| aktosecurity/ | 853e37321e6e | ip-address | 10.7.1 | 1 |
| alazidis/ | 602d4f7f090c | ip-address | 10.7.1 | 1 |
| alquimiaai/ | 38a1f0341982 | ip-address | 10.7.1 | 1 |
| anamskenneth/ | 9b7d2cd389b7 | ip-address | 10.7.1 | 1 |
| anamskenneth/ | 9ecf04f42cc3 | ip-address | 10.7.1 | 1 |
| apecloud/ | b3ae37840ace | ip-address | 10.7.1 | 1 |
| arbuzov/ | 2d7dd8070610 | ip-address | 10.7.1 | 1 |
| archivebox/ | 8c21bb233130 | ip-address | 10.7.1 | 1 |
| automatischio/ | 3bace7a12d5f | ip-address | 10.7.1 | 1 |
| baserow/ | df0c42eb67e8 | ip-address | 10.7.1 | 1 |
| beyzkaya/ | 12a6a3d1c5f9 | ip-address | 10.7.1 | 1 |
| bluerange/ | 90a4e5b92cc6 | ip-address | 10.7.1 | 1 |
| bnjbvr/ | 37e216b182c8 | ip-address | 10.7.1 | 1 |
| budibase/ | 44fe6feab985 | ip-address | 10.7.1 | 1 |
| budibase/ | d90f656261c9 | ip-address | 10.7.1 | 1 |
| budibase/ | de5e2e560ce8 | ip-address | 10.7.1 | 1 |
| carlosmz87/ | 8ffa63aa995d | ip-address | 10.7.1 | 1 |
| catalysm/ | f003b35f54d9 | ip-address | 10.7.1 | 1 |
| cccs/ | c00e72d90666 | ip-address | 10.7.1 | 1 |
| chainsafe/ | 7b9fe4aa8073 | ip-address | 10.7.1 | 1 |
| chainsafe/ | d717e4193699 | ip-address | 10.7.1 | 1 |
| chandanteekinavar/ | 49e164a9a439 | ip-address | 10.7.1 | 1 |
| chatwoot/ | b419dded7e9d | ip-address | 10.7.1 | 1 |
| chibisafe/ | 836467a50792 | ip-address | 10.7.1 | 1 |
| chibisafe/ | 3da4fcbc1a18 | ip-address | 10.7.1 | 1 |
| chocobozzz/ | 052712130691 | ip-address | 10.7.1 | 1 |
| christianhuth/ | c07f414a3e4b | ip-address | 10.7.1 | 1 |
| codetogether/ | 4348c8a38752 | ip-address | 10.7.1 | 1 |
| codiacimages/ | 0cd44ca7a7ee | ip-address | 10.7.1 | 1 |
| contane/ | efb98bdcc4e9 | ip-address | 10.7.1 | 1 |