CVE-2026-101912
MediumAdvisory
Published 29 Sept 2026In the index since 30 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- 0.004
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 567
- of 17,957 indexed, latest versions
- Container images
- 573
- deployed by those charts
- Fix available
- 1 of 1
- affected package
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
Carried by container images the latest versions of 567 of 17,957 indexed charts deploy, on 573 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| ip-addressnpm | 5.9.4, 6.1.0, 6.4.0, 7.1.0+11 more | 10.7.1 | 573 |
- OSV records
- GHSA-j6r3-76f7-8jcv
- Trending
- Rank 24 in indexed charts, since 30 Sept 2026. See the ranking →
Charts affected
567 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| terminal-clientkrateo | 0.1.3 | 1 of 1See more | 7,159 |
| terminal-serverkrateo | 0.1.6 | 1 of 1See more | 7,112 |
| pangolinkrzwiatrzyk | 0.11.0 | 1 of 1See more | 3,642 |
| aperagkubeblocksVerified publisher | 0.0.0-nightly | 1 of 3See more | 9,109 |
| ghostkubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 3,111 |
| homepagekubernetes-homelab-helm-chartsVerified publisher | 0.1.0 | 1 of 1See more | 1,443 |
| portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher | 0.1.0 | 1 of 3See more | 1,503 |
| seerrkubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 2,813 |
| umamikubernetes-homelab-helm-chartsVerified publisher | 0.1.0 | 1 of 3See more | 2,478 |
| uptime-kumakubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 6,973 |
| kube-mailkubernetes-replicator | 0.11.1 | 1 of 3See more | 2,782 |
| penpotkubitodevVerified publisher | 1.2.1 | 1 of 5See more | 18,366 |
| kubiya-runnerkubiya-helm-chartsOfficialVerified publisher | 0.9.4 | 1 of 9See more | 21,336 |
| landing-pagelanding-pageVerified publisher | 0.1.0 | 1 of 1See more | 1,229 |
| helm-pilotlbenicio-communityVerified publisher | 0.2.4 | 1 of 1See more | 784 |
| homebridgelbenicio-communityVerified publisher | 0.1.15 | 1 of 1See more | 39,947 |
| jellyseerrlbenicio-communityVerified publisher | 0.1.0 | 1 of 1See more | 3,817 |
| stremiolbenicio-communityVerified publisher | 0.1.1 | 1 of 2See more | 2,867 |
| uptime-kumalbenicio-communityVerified publisher | 0.1.1 | 1 of 1See more | 36,169 |
| dashboardleechistest | 1.0.0 | 1 of 1See more | 1,546 |
| libredb-studiolibredb-studio-oci | 0.1.72 | 1 of 1See more | 1,172 |
| linkdinglinkding | 0.2.3 | 1 of 1See more | 40,743 |
| node-redlmatfyVerified publisher | 0.1.6 | 1 of 1See more | 1,974 |
| zigbee2mqttlmatfyVerified publisher | 0.1.14 | 1 of 2See more | 1,488 |
| uptime-kumaloeken-at-homeVerified publisher | 2.3.2 | 1 of 1See more | 36,169 |
| redisinsightlogic3579Verified publisher | 3.4.0 | 1 of 1See more | 1,688 |
| logtidelogtideVerified publisher | 2.1.14 | 2 of 4See more | 3,159 |
| mongo_guilovemew67Verified publisher | 0.0.2 | 1 of 1See more | 2,157 |
| lynxpromptlynxpromptVerified publisher | 0.1.2 | 1 of 3See more | 1,871 |
| hyperglassm0nsterrr-hyperglassVerified publisher | 4.2.1 | 1 of 2See more | 5,020 |
| homepagem0sh1-helm-charts | 0.3.1 | 1 of 1See more | 1,921 |
| wudm0sh1-helm-charts | 0.2.0 | 1 of 1See more | 6,860 |
| magistralamagistrala-devopsVerified publisher | 0.16.2 | 1 of 42See more | 25,277 |
| docker-mailservermailserverVerified publisher | 0.2.65 | 1 of 9See more | 11,856 |
| mauticmautic-chartVerified publisher | 1.0.2 | 1 of 3See more | 9,063 |
| claude-code-apimcp-helmVerified publisher | 0.1.1 | 1 of 1See more | 4,347 |
| mcp-gitlabmcp-helmVerified publisher | 0.3.4 | 1 of 1See more | 1,165 |
| mcp-kubernetesmcp-helmVerified publisher | 0.2.7 | 1 of 1See more | 6,120 |
| mcpomcp-helmVerified publisher | 0.2.8 | 1 of 1See more | 4,927 |
| mcp-playwrightmcp-helmVerified publisher | 0.1.1 | 1 of 1See more | 4,553 |
| searchmcp-helmVerified publisher | 0.1.3 | 1 of 2See more | 9,895 |
| backstagemcwarmanVerified publisher | 0.10.10 | 1 of 2See more | 10,534 |
| homarrmedia-servarrVerified publisher | 0.55.3 | 1 of 1See more | 614 |
| miot-appmicroboxlabs | 0.3.3 | 1 of 1See more | 583 |
| miot-dashboard-servermicroboxlabs | 0.1.2 | 1 of 1See more | 192 |
| miot-docsmicroboxlabs | 0.1.1 | 1 of 1See more | 259 |
| miot-stackmicroboxlabs | 0.2.2 | 1 of 2See more | 583 |
| modulariotmicroboxlabs | 0.11.0 | 2 of 4See more | 2,373 |
| mini-blogmini-blog-helm | 0.1.0 | 1 of 3See more | 13,616 |
| aws-api-gateway-operatormintel | 0.1.2 | 2 of 11See more | 11,131 |
Container images carrying it
573 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 82d0b161161d | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 81afafdd96a5 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 643bd0be730d | ip-address | 10.7.1 | 2 |
| ghcr.io/ | b434cb9287ee | ip-address | 10.7.1 | 2 |
| ghcr.io/ | ce4d58724e25 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 7e2ef5261764 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | ca31ec35b829 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | f4768de5f616 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 0e7bc9d34e86 | ip-address | 10.7.1 | 2 |
| ghcr.io/ | 5f26407fd2ed | ip-address | 10.7.1 | 2 |
| aaronshaf/ | ac41724cd997 | ip-address | 10.7.1 | 1 |
| activepieces/ | 58414dfc94c4 | ip-address | 10.7.1 | 1 |
| activepieces/ | a12efde0c535 | ip-address | 10.7.1 | 1 |
| activepieces/ | c26188b44e62 | ip-address | 10.7.1 | 1 |
| actualbudget/ | 58fecd9088b7 | ip-address | 10.7.1 | 1 |
| adeptiainc/ | 283001e83739 | ip-address | 10.7.1 | 1 |
| adeptiainc/ | 31f295e948e6 | ip-address | 10.7.1 | 1 |
| agentarea/ | cc575d17d174 | ip-address | 10.7.1 | 1 |
| agentarea/ | be4a11f799b2 | ip-address | 10.7.1 | 1 |
| akeyless/ | d4768a9b089c | ip-address | 10.7.1 | 1 |
| aktosecurity/ | 853e37321e6e | ip-address | 10.7.1 | 1 |
| alazidis/ | 602d4f7f090c | ip-address | 10.7.1 | 1 |
| alquimiaai/ | 38a1f0341982 | ip-address | 10.7.1 | 1 |
| anamskenneth/ | 9b7d2cd389b7 | ip-address | 10.7.1 | 1 |
| anamskenneth/ | 9ecf04f42cc3 | ip-address | 10.7.1 | 1 |
| apecloud/ | b3ae37840ace | ip-address | 10.7.1 | 1 |
| arbuzov/ | 2d7dd8070610 | ip-address | 10.7.1 | 1 |
| archivebox/ | 8c21bb233130 | ip-address | 10.7.1 | 1 |
| automatischio/ | 3bace7a12d5f | ip-address | 10.7.1 | 1 |
| baserow/ | df0c42eb67e8 | ip-address | 10.7.1 | 1 |
| beyzkaya/ | 12a6a3d1c5f9 | ip-address | 10.7.1 | 1 |
| bluerange/ | 90a4e5b92cc6 | ip-address | 10.7.1 | 1 |
| bnjbvr/ | 37e216b182c8 | ip-address | 10.7.1 | 1 |
| budibase/ | 44fe6feab985 | ip-address | 10.7.1 | 1 |
| budibase/ | d90f656261c9 | ip-address | 10.7.1 | 1 |
| budibase/ | de5e2e560ce8 | ip-address | 10.7.1 | 1 |
| carlosmz87/ | 8ffa63aa995d | ip-address | 10.7.1 | 1 |
| catalysm/ | f003b35f54d9 | ip-address | 10.7.1 | 1 |
| cccs/ | c00e72d90666 | ip-address | 10.7.1 | 1 |
| chainsafe/ | 7b9fe4aa8073 | ip-address | 10.7.1 | 1 |
| chainsafe/ | d717e4193699 | ip-address | 10.7.1 | 1 |
| chandanteekinavar/ | 49e164a9a439 | ip-address | 10.7.1 | 1 |
| chatwoot/ | b419dded7e9d | ip-address | 10.7.1 | 1 |
| chibisafe/ | 836467a50792 | ip-address | 10.7.1 | 1 |
| chibisafe/ | 3da4fcbc1a18 | ip-address | 10.7.1 | 1 |
| chocobozzz/ | 052712130691 | ip-address | 10.7.1 | 1 |
| christianhuth/ | c07f414a3e4b | ip-address | 10.7.1 | 1 |
| codetogether/ | 4348c8a38752 | ip-address | 10.7.1 | 1 |
| codiacimages/ | 0cd44ca7a7ee | ip-address | 10.7.1 | 1 |
| contane/ | efb98bdcc4e9 | ip-address | 10.7.1 | 1 |