{"action":"Upgrade ip-address to 10.7.1 or later.","affected":[{"fixed":"10.7.1","introduced":"0"}],"component":"ip-address","cve_ids":["CVE-2026-101911"],"ecosystem":"npm","epss":0.00383,"exploited":false,"fixed_versions":["10.7.1"],"ghsa_id":"GHSA-h3mg-xc3c-68pw","id":"tcs_01M5KFT0J308YXJTJJS1EVA768","modified_at":"2026-09-30T00:00:04.407982988Z","published_at":"2026-09-29T23:46:39Z","references":["https://osv.dev/vulnerability/GHSA-h3mg-xc3c-68pw","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-h3mg-xc3c-68pw","url":"https://osv.dev/vulnerability/GHSA-h3mg-xc3c-68pw"}],"summary":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process"}