CVE-2026-111997
Fixed in a distro release EPSS <1%CVSS 6.3
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
Products: beaugunderson ip-address
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | ip-address | 10.7.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | actions-runner | 2.338.1-r1 |
| Chainguard | code-server | 4.141.0-r4 |
| Chainguard | eco-jess | 2026.10.1.001-r2 |
| Chainguard | graalvm-25-ce-nodejs | no fix |
| Chainguard | graalvm-25.1-ce-nodejs | no fix |
| Chainguard | graalvm-25.2-ce-nodejs | no fix |
| Chainguard | homepage | 2.6.0-r3 |
| Chainguard | kibana-9.3 | no fix |
| Chainguard | lerna | 10.1.1-r2 |
| Chainguard | node-red | 5.0.9-r1 |
| Chainguard | npm-11 | no fix |
| Chainguard | prism | 5.16.0-r18 |
| Chainguard | renovate | no fix |
| Chainguard | unleash | 8.2.1-r2 |
| Chainguard | unleash-proxy | 1.4.20-r0 |
| Chainguard | wazuh-dashboard | no fix |
| Chainguard | wazuh-dashboard-fips | no fix |
| Chainguard | wazuh-dashboard-security-plugin | no fix |
| Chainguard | wazuh-dashboard-security-plugin-fips | no fix |
| Debian 12 | node-ip-address | no fix |
| Debian 13 | node-ip-address | no fix |
| Debian 14 | node-ip-address | no fix |
| Ubuntu 20.04 LTS | node-ip-address | no fix |
| Ubuntu 22.04 LTS | node-ip-address | no fix |
| Ubuntu 24.04 LTS | node-ip-address | no fix |
| Ubuntu 26.04 LTS | node-ip-address | no fix |
| Ubuntu 26.10 | node-ip-address | no fix |
| Wolfi | code-server | 4.141.0-r4 |
| Wolfi | lerna | 10.1.1-r2 |
| Wolfi | prism | 5.16.0-r18 |
| Wolfi | renovate | no fix |