ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to
    10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without
    validating that both operands use the same IP family. A cross-family containment check whose leading
    address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an
    address space. An allowlist or denylist decision can therefore classify an address outside the intended
    range as contained. This issue is fixed in version 10.7.1. (CVE-2026-101912)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to     10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without     validating that both operands use the same IP family. A cross-family containment check whose leading     address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an     address space. An allowlist or denylist decision can therefore classify an address outside the intended     range as contained. This issue is fixed in version 10.7.1. (CVE-2026-101912)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473560	Echo: ip-address: security update to 10.7.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473560	Echo: ip-address: security update to 10.7.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
351010	Linux Distros Unpatched Vulnerability : CVE-2026-101912	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-101912

medium

Tenable Plugins

medium

medium

medium