npm/ip-address: medium

Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-p3hm-x653-5rc6
• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5
• https://nvd.nist.gov/vuln/detail/CVE-2026-111997

published 2026-10-18T03:32:37Z · modified 2026-10-22T16:30:40.995068614Z · JSON