From 029f5e85c1909edf6a0580584c5dcf60fa16e8c9 Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Fri, 7 Aug 2026 17:49:10 +0530 Subject: [PATCH] =?UTF-8?q?LTS-4657:=20override=20ip-address=20to=20^10.4.?= =?UTF-8?q?0=20=E2=80=94=20fixes=20GHSA-mwp4-54f8-5fhr=20(leading-zero=20o?= =?UTF-8?q?ctet=20SSRF)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ip-address 10.2.0 arrives transitively via socks (^10.1.1) under browserstack-node-sdk -> @kubernetes/client-node -> socks-proxy-agent, and via proxy-agent/pac-proxy-agent under @wdio/utils. Address4 decoded a leading-zero octet as decimal while resolvers decode it as octal, so isPrivate()/isInSubnet() could misclassify an internal target as public. 10.4.0 clears all three open advisories on the installed 10.2.0: GHSA-mwp4-54f8-5fhr (high, <= 10.3.0) patched 10.3.1 GHSA-4xrf-jv44-h6hh (medium, 10.1.1 - 10.2.1) patched 10.2.2 GHSA-22jq-vg5j-6vgg (medium, 10.1.1 - 10.2.0) patched 10.2.1 Verified: npm ci from this lock installs ip-address@10.4.0 (overridden), npm audit no longer reports ip-address, and the advisory PoC now behaves as patched — Address4.isValid('012.0.0.1') === false and the constructor throws AddressError, while '10.0.0.1' still parses. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 6 +++--- package.json | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1222f60..7508ceb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6424,9 +6424,9 @@ } }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.4.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz", + "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index d12d341..1859f7c 100644 --- a/package.json +++ b/package.json @@ -37,6 +37,7 @@ "tmp": "0.2.7", "esbuild": "^0.28.1", "serialize-javascript": "^7.0.3", + "ip-address": "^10.4.0", "glob@10": { "minimatch": "^9.0.7" },