CVE-2026-111997
Medium
Description
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
SeverityMedium
CVSS6.3
Exploit probability—
ProductIp-address
PublishedOct 18, 2026
First seenOct 18, 2026
Weakness typeCWE-1333CWE-1333
How to fix
Update
- ip-address10.7.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ip-addressnpm | v < 10.7.4 | 10.7.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.