Description
npm bundles ip-address@10.2.0 (via make-fetch-happen → @npmcli/agent → socks-proxy-agent → socks), which is affected by GHSA-mwp4-54f8-5fhr / CVE-2026-69192 (high severity). Address4 decodes leading-zero octets as decimal while resolvers (WHATWG URL, inet_aton, getaddrinfo) decode them as octal, which can allow SSRF / trust-boundary bypass.
The issue is fixed upstream in ip-address@10.3.1 (released 2026-07-25). socks@2.8.9's own dependency range (^10.1.1) already permits this fixed version, but npm's own bundled lockfile hasn't been refreshed to pick it up — the latest published CLI versions (11.19.0 and 12.0.2, both from 2026-07-29) still ship the vulnerable ip-address@10.2.0.
Expected Behavior
A new npm CLI release with a refreshed lockfile bundling ip-address@10.3.1 or later.
Actual Behavior
Latest npm CLI releases (checked 11.19.0, 12.0.0, 12.0.1, 12.0.2) all bundle ip-address@10.2.0.
Steps To Reproduce
npm pack npm@12.0.2
tar -xzf npm-12.0.2.tgz -O package/node_modules/ip-address/package.json | grep version
# => "version": "10.2.0"
Environment
Description
npm bundles
ip-address@10.2.0(viamake-fetch-happen→@npmcli/agent→socks-proxy-agent→socks), which is affected by GHSA-mwp4-54f8-5fhr / CVE-2026-69192 (high severity).Address4decodes leading-zero octets as decimal while resolvers (WHATWG URL,inet_aton,getaddrinfo) decode them as octal, which can allow SSRF / trust-boundary bypass.The issue is fixed upstream in
ip-address@10.3.1(released 2026-07-25).socks@2.8.9's own dependency range (^10.1.1) already permits this fixed version, but npm's own bundled lockfile hasn't been refreshed to pick it up — the latest published CLI versions (11.19.0and12.0.2, both from 2026-07-29) still ship the vulnerableip-address@10.2.0.Expected Behavior
A new npm CLI release with a refreshed lockfile bundling
ip-address@10.3.1or later.Actual Behavior
Latest npm CLI releases (checked
11.19.0,12.0.0,12.0.1,12.0.2) all bundleip-address@10.2.0.Steps To Reproduce
Environment