diff --git a/src/core/thread/network_data.cpp b/src/core/thread/network_data.cpp
index 4bdd6509b..583a6b757 100644
--- a/src/core/thread/network_data.cpp
+++ b/src/core/thread/network_data.cpp
@@ -143,7 +143,7 @@ otError NetworkData::GetNextOnMeshPrefix(otNetworkDataIterator *aIterator, uint1
         aConfig->mConfigure = borderRouterEntry->IsConfigure();
         aConfig->mDefaultRoute = borderRouterEntry->IsDefaultRoute();
         aConfig->mOnMesh = borderRouterEntry->IsOnMesh();
-        aConfig->mStable = cur->IsStable();
+        aConfig->mStable = borderRouter->IsStable();
         aConfig->mRloc16 = borderRouterEntry->GetRloc();
 
         iterator.SetTlvsIndex(static_cast<uint8_t>(reinterpret_cast<uint8_t *>(cur) - mTlvs));
@@ -207,7 +207,7 @@ otError NetworkData::GetNextExternalRoute(otNetworkDataIterator *aIterator, uint
         memcpy(&aConfig->mPrefix.mPrefix, prefix->GetPrefix(), BitVectorBytes(prefix->GetPrefixLength()));
         aConfig->mPrefix.mLength = prefix->GetPrefixLength();
         aConfig->mPreference = hasRouteEntry->GetPreference();
-        aConfig->mStable = cur->IsStable();
+        aConfig->mStable = hasRoute->IsStable();
         aConfig->mRloc16 = hasRouteEntry->GetRloc();
         aConfig->mNextHopIsThisDevice = (hasRouteEntry->GetRloc() == GetNetif().GetMle().GetRloc16());
 
diff --git a/src/core/thread/network_data_leader_ftd.cpp b/src/core/thread/network_data_leader_ftd.cpp
index 543b5b252..1410fbec1 100644
--- a/src/core/thread/network_data_leader_ftd.cpp
+++ b/src/core/thread/network_data_leader_ftd.cpp
@@ -447,7 +447,7 @@ otError Leader::RlocLookup(uint16_t aRloc16, bool &aIn, bool &aStable, uint8_t *
                 switch (subCur->GetType())
                 {
                 case NetworkDataTlv::kTypeBorderRouter:
-                    borderRouter = FindBorderRouter(*prefix);
+                    borderRouter = static_cast<BorderRouterTlv *>(subCur);
 
                     for (uint8_t i = 0; i < borderRouter->GetNumEntries(); i++)
                     {
@@ -467,7 +467,7 @@ otError Leader::RlocLookup(uint16_t aRloc16, bool &aIn, bool &aStable, uint8_t *
                     break;
 
                 case NetworkDataTlv::kTypeHasRoute:
-                    hasRoute = FindHasRoute(*prefix);
+                    hasRoute = static_cast<HasRouteTlv *>(subCur);
 
                     for (uint8_t i = 0; i < hasRoute->GetNumEntries(); i++)
                     {