Most recent entries from all

CLEANSTART-2026-TS24569 — ip-address before 10

Affected: CleanStart: npm

Security vulnerability affects the npm package. ip-address before 10.

fkie_cve-2026-111997

ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.

Withdrawn: GHSA-p3hm-x653-5rc6 — Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowin…

Withdrawn by the publisher.

Affected: npm: ip-address

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-rxp7-6hxx-x8q5. This link is maintained to preserve external references.

## Original Description ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.

UBUNTU-CVE-2026-111997

Affected: Ubuntu:20.04:LTS: node-ip-address, Ubuntu:22.04:LTS: node-ip-address, Ubuntu:24.04:LTS: node-ip-address, Ubuntu:26.10: node-ip-address, Ubuntu:26.04:LTS: node-ip-address

(ip-address before 10.7.4 allows a denial of service (CPU consumption f ...)