CVE-2026-111997: Medium severity npm/ip-address vulnerability
Published Oct 18, 2026
·Updated
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
Affected Software
1 affected component
npm/ip-address<10.7.4
Event History
Oct 18, 2026
CVE Published
via MITRE·12:07 AM
Data Sourced
via MITRE·12:07 AM
DescriptionWeakness
Data Sourced
via NVD·01:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What input is required to trigger the denial of service?
An attacker needs to supply input containing many percent (%) characters that reaches a function call using the Address6 constructor.
2
Which deployments are exposed?
Deployments using versions of the npm ip-address package before 10.7.4 are affected if untrusted input can reach the Address6 constructor.
3
What is the impact of successful exploitation?
The crafted input causes quadratic CPU consumption and can stall the application, resulting in denial of service.