ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55603 advisory.

    - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149       (memory exhaustion via deeply chained brace groups). as well as       CVE-2026-14257 (fixed in 5.0.8).
    - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address
    - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar
    - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
    - Fix CVE-2026-69152 - brace-expansion

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1566:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54371 advisory.

    - deps: update npm/brace-expansion to 5.9.0       Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152       Resolves: RHEL-223388 RHEL-223907 RHEL-223792
    - Backport patch update sqlite to 3.53.4       Fixes: CVE-2026-11824, CVE-2026-11822       Resolves: RHEL-218252 RHEL-218257
    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-194176 RHEL-194179 RHEL-208658
    - Rebase npm/brace-expansion to 5.0.9       Fixes: CVE-2026-69152       Resolves: RHEL-223789

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23130-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23131-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21545-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21546-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3557-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3521-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3520-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58041: `node:sqlite` `SQLTagStore` iterator replay can re-execute writes (bsc#1272946).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

    Other updates and bugfixes:

    - Version 24.18.0:
      * fix: severe regression in security update 24.17 of nodejs24 (bsc#1269825)
      * doc: update blockList stability status to release candidate
      * fs: support caller-supplied readFile() buffers
      * http: close pre-request sockets in closeIdleConnections
      * loader: implement package maps
      * net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
      * tls: add certificateCompression option
      * vfs: dispatch node:fs/promises to mounted VFS instances
      * vfs: add minimal node:vfs subsystem

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions
    10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6
    addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-
    use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped
    range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched
    their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType()
    against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6
    ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so
    a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For
    IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any
    dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability
    additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version
    10.2.1. (CVE-2026-54272)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions     10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6     addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-     use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped     range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched     their own NAT64  labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType()     against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6     ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so     a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For     IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any     dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability     additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version     10.2.1. (CVE-2026-54272)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
337859	Oracle Linux 9 : nodejs:24 (ELSA-2026-55603)	Nessus	Oracle Linux Local Security Checks	Local	high
337728	MiracleLinux 8 : [security - high] nodejs:24 (AXSA:2026-1566:01)	Nessus	Miracle Linux Local Security Checks	Local	high
335747	Oracle Linux 8 : nodejs:24 (ELSA-2026-54371)	Nessus	Oracle Linux Local Security Checks	Local	high
335502	SUSE SLES16 Security Update : nodejs22 (SUSE-SU-2026:23130-1)	Nessus	SuSE Local Security Checks	Local	medium
335490	SUSE SLES16 Security Update : nodejs24 (SUSE-SU-2026:23131-1)	Nessus	SuSE Local Security Checks	Local	medium
335109	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21545-1)	Nessus	SuSE Local Security Checks	Local	medium
335045	openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21546-1)	Nessus	SuSE Local Security Checks	Local	medium
334718	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3557-1)	Nessus	SuSE Local Security Checks	Local	medium
333281	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3521-1)	Nessus	SuSE Local Security Checks	Local	medium
333280	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:3520-1)	Nessus	SuSE Local Security Checks	Local	medium
445615	SCA: security update for ip-address (GHSA-22jq-vg5j-6vgg)	Tenable Cloud Security	SCA Checks	Local	medium
445615	SCA: security update for ip-address (GHSA-22jq-vg5j-6vgg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
330380	Linux Distros Unpatched Vulnerability : CVE-2026-54272	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-54272

medium

Tenable Plugins

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium