{"action":"Upgrade ip-address to 10.7.4 or later.","affected":[{"fixed":"10.7.4","introduced":"0"}],"component":"ip-address","cve_ids":["CVE-2026-111997"],"ecosystem":"npm","exploited":false,"fixed_versions":["10.7.4"],"ghsa_id":"GHSA-rxp7-6hxx-x8q5","id":"tcs_01M5JMCTA71F76JSV9AF0HWZGX","modified_at":"2026-10-22T16:30:30.129356757Z","published_at":"2026-10-22T16:19:39Z","references":["https://osv.dev/vulnerability/GHSA-rxp7-6hxx-x8q5","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-rxp7-6hxx-x8q5","url":"https://osv.dev/vulnerability/GHSA-rxp7-6hxx-x8q5"},{"source":"nvd","source_id":"CVE-2026-111997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997"}],"summary":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process"}