cyfenced.com →

[ CVE-2026-111997 · Published 18 Oct 2026 ]

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

CVSS 6.3 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.

[ Fixes ]Fixes and patches

  • ip-address 10.7.4Fixed version · GitHub Advisories · npm package ip-address: upgrade to 10.7.4 or later (affected <= 10.7.3)

[ Packages ]Affected open-source packages

[ References ]References