Read the docs
TI-2026-76149 Aliases CVE-2026-111997GHSA-p3hm-x653-5rc6GHSA-rxp7-6hxx-x8q5

Denial of service in ip-address via many percent characters in input

Priority HIGH 67CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

The ip-address package before 10.7.4 has a flaw with quadratic complexity in how it parses input (CWE-1333). A remote attacker without privileges or user interaction can send input with many percent characters to a function that uses the Address6 constructor, consuming CPU and stalling the application. The CVSS 4.0 score is 6.3 (medium), with impact limited to availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed ip-address (beaugunderson): 10.7.4ip-address (npm): 10.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
beaugundersonip-addressbefore 10.7.410.7.4Patch availableCNA
—ip-address (npm)before 10.7.410.7.4Patch availableGHSA-rxp7-6hxx-x8q5
  • ip-address Vendorbeaugunderson Affected before 10.7.4 Fixed in 10.7.4 Patch available CNA
  • ip-address (npm) Vendor— Affected before 10.7.4 Fixed in 10.7.4 Patch available GHSA-rxp7-6hxx-x8q5

Remediation

Upgrade ip-address to version 10.7.4, which fixes this issue in both the beaugunderson and npm listings of the product.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA ip-address (beaugunderson) Fixed in 10.7.4
  • Fix · GHSA-rxp7-6hxx-x8q5 ip-address (npm) Fixed in 10.7.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-111997
  2. 2026-10-18 Alias added: GHSA-p3hm-x653-5rc6
  3. 2026-10-18 Affected versions changed · Red Hat
  4. 2026-10-18 CVSS score added · Red Hat
  5. 2026-10-20 Affected versions changed · Red Hat
  6. 2026-10-22 Alias added: GHSA-rxp7-6hxx-x8q5
  7. 2026-10-22 Fix available: npm/[email protected] · GHSA-rxp7-6hxx-x8q5
  8. 2026-10-22 CVSS score added · GHSA-rxp7-6hxx-x8q5
  9. 2026-10-22 Weakness changed · GHSA-rxp7-6hxx-x8q5
  10. 2026-10-22 5 new references · GHSA-rxp7-6hxx-x8q5

References

Advisory 1

Other 4

  • TI-2026-48541 Improper input validation in beaugunderson ip-address CVSS 4.0HIGH 7.7
  • TI-2026-39172 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks CVSS 4.0MEDIUM 6.9
  • TI-2026-65213 Incorrect comparison in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65212 Uncontrolled resource consumption in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65211 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass CVSS 4.0MEDIUM 6.9
  • TI-2026-48543 Improper input validation in beaugunderson ip-address CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences