{"source":1130722,"name":"ip-address","dependency":"ip-address","title":"ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass","url":"https://github.com/advisories/GHSA-mwp4-54f8-5fhr","severity":"high","versions":["3.2.0","3.2.1","4.0.0","4.1.0","4.2.0","5.0.1","5.0.2","5.1.0","5.1.1","5.2.0","5.3.0","5.4.0","5.4.1","5.5.0","5.6.0","5.7.0","5.8.0","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","5.8.7","5.8.8","5.8.9","5.9.0","5.9.1","5.9.2","5.9.3","5.9.4","6.0.0","6.1.0","6.2.0","6.3.0","6.4.0","7.0.0-beta.0","7.0.0-beta.1","7.0.0","7.0.1","7.1.0","8.0.0","8.1.0","9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.1.0-0","10.0.0","10.0.1","10.1.0","10.1.1","10.2.0","10.2.1","10.2.2","10.3.0","10.3.1","10.4.0","10.5.0"],"vulnerableVersions":["3.2.0","3.2.1","4.0.0","4.1.0","4.2.0","5.0.1","5.0.2","5.1.0","5.1.1","5.2.0","5.3.0","5.4.0","5.4.1","5.5.0","5.6.0","5.7.0","5.8.0","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","5.8.7","5.8.8","5.8.9","5.9.0","5.9.1","5.9.2","5.9.3","5.9.4","6.0.0","6.1.0","6.2.0","6.3.0","6.4.0","7.0.0-beta.0","7.0.0-beta.1","7.0.0","7.0.1","7.1.0","8.0.0","8.1.0","9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.1.0-0","10.0.0","10.0.1","10.1.0","10.1.1","10.2.0","10.2.1","10.2.2","10.3.0"],"cwe":["CWE-20","CWE-918"],"cvss":{"score":0,"vectorString":null},"range":"<=10.3.0","id":"iZ6eqftXQ5U7oxxwm1FqwNnsmmgaiEiPNMWwV0yEYoA92hylUZDRGksj2tTX69LoRE19mpn7CYQC1Yylb7gTNg=="}