[ Vendor · 5 CVEs ]
beaugunderson
CVEs affecting beaugunderson published in the last 30 days, plus any beaugunderson CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111997 | 18 Oct 2026 | CVSS 6.3 | ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the processip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input… | Fix |
| CVE-2026-101912 | 28 Sep 2026 | CVSS 6.3 | ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its rangeip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet… | Fix |
| CVE-2026-101913 | 28 Sep 2026 | CVSS 6.3 | ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in… | Fix |
| CVE-2026-101910 | 28 Sep 2026 | CVSS 6.9 | ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypassip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate… | Fix |
| CVE-2026-101911 | 28 Sep 2026 | CVSS 6.3 | ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor… | Fix |