Bundled ip-address dependency vulnerable to SSRF (CVE-2026-69192 / GHSA-mwp4-54f8-5fhr)

[kennym]

Description

npm bundles ip-address@10.2.0 (via make-fetch-happen → @npmcli/agent → socks-proxy-agent → socks), which is affected by GHSA-mwp4-54f8-5fhr / CVE-2026-69192 (high severity). Address4 decodes leading-zero octets as decimal while resolvers (WHATWG URL, inet_aton, getaddrinfo) decode them as octal, which can allow SSRF / trust-boundary bypass.

The issue is fixed upstream in ip-address@10.3.1 (released 2026-07-25). socks@2.8.9's own dependency range (^10.1.1) already permits this fixed version, but npm's own bundled lockfile hasn't been refreshed to pick it up — the latest published CLI versions (11.19.0 and 12.0.2, both from 2026-07-29) still ship the vulnerable ip-address@10.2.0.

Expected Behavior

A new npm CLI release with a refreshed lockfile bundling ip-address@10.3.1 or later.

Actual Behavior

Latest npm CLI releases (checked 11.19.0, 12.0.0, 12.0.1, 12.0.2) all bundle ip-address@10.2.0.

Steps To Reproduce

npm pack npm@12.0.2
tar -xzf npm-12.0.2.tgz -O package/node_modules/ip-address/package.json | grep version
# => "version": "10.2.0"

Environment

• npm: 11.19.0 / 12.0.2
• Advisory: GHSA-mwp4-54f8-5fhr

[mghadley]

We are blocked by this as GCP container scanners flag this as a high vulnerability and there is no override we can use to fix it downstream.

• A flat "overrides": { "ip-address": "^10.3.1" } leaves the resolved version at 10.2.0
• A nested "overrides": { "npm": { "ip-address": "^10.3.1" } } also leaves it at 10.2.0
• npm ci --omit=dev doesn't help, because the copy that lands in a production image comes from npm install -g npm@11 in the image's runtime stage, not from the project tree

[martinrrm]

This should be fixed when #9871 is merged