medium6.3
CVE-2026-111997
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching …
Impact
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ip-address | <= 10.7.3 | 10.7.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-rxp7-6hxx-x8q5
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5
- https://nvd.nist.gov/vuln/detail/CVE-2026-111997
- https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd
- https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4