Bundled ip-address dependency vulnerable to SSRF (CVE-2026-69192 / GHSA-mwp4-54f8-5fhr) #9867

Description

npm bundles ip-address@10.2.0 (via make-fetch-happen → @npmcli/agent → socks-proxy-agent → socks), which is affected by GHSA-mwp4-54f8-5fhr / CVE-2026-69192 (high severity). Address4 decodes leading-zero octets as decimal while resolvers (WHATWG URL, inet_aton, getaddrinfo) decode them as octal, which can allow SSRF / trust-boundary bypass.

The issue is fixed upstream in ip-address@10.3.1 (released 2026-07-25). socks@2.8.9's own dependency range (^10.1.1) already permits this fixed version, but npm's own bundled lockfile hasn't been refreshed to pick it up — the latest published CLI versions (11.19.0 and 12.0.2, both from 2026-07-29) still ship the vulnerable ip-address@10.2.0.

Expected Behavior

A new npm CLI release with a refreshed lockfile bundling ip-address@10.3.1 or later.

Actual Behavior

Latest npm CLI releases (checked 11.19.0, 12.0.0, 12.0.1, 12.0.2) all bundle ip-address@10.2.0.

Steps To Reproduce

npm pack npm@12.0.2
tar -xzf npm-12.0.2.tgz -O package/node_modules/ip-address/package.json | grep version
# => "version": "10.2.0"

Environment

• npm: 11.19.0 / 12.0.2
• Advisory: GHSA-mwp4-54f8-5fhr