ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0
    until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use
    range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-
    boundary decision can treat an internal IPv4 destination encoded through that range as external.
    Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use
    range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version
    10.5.1. (CVE-2026-101910)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0     until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use     range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-     boundary decision can treat an internal IPv4 destination encoded through that range as external.
    Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use     range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version     10.5.1. (CVE-2026-101910)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473558	Echo: ip-address: security update to 10.5.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473558	Echo: ip-address: security update to 10.5.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
448449	SCA: security update for ip-address (GHSA-2vr4-cq9g-pvrc)	Tenable Cloud Security	SCA Checks	Local	medium
448449	SCA: security update for ip-address (GHSA-2vr4-cq9g-pvrc)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
351093	Linux Distros Unpatched Vulnerability : CVE-2026-101910	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-101910

medium

Tenable Plugins

medium

medium

medium

medium

medium