Vulnerability · Published Oct 18, 2026 · Assigned by mitre
CVE-2026-111997
Medium 6.3
In plain English
A medium-severity regular-expression denial of service in ip-address from beaugunderson. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.3%top 75.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-ip-address | no fix listed | DEBIAN-CVE-2026-111997 |
| Debian:13 | node-ip-address | no fix listed | DEBIAN-CVE-2026-111997 |
| Debian:14 | node-ip-address | 10.7.4-1 | DEBIAN-CVE-2026-111997 |
| Ubuntu:22.04:LTS | node-ip-address | no fix listed | UBUNTU-CVE-2026-111997 |
| Ubuntu:24.04:LTS | node-ip-address | no fix listed | UBUNTU-CVE-2026-111997 |
| Ubuntu:26.04:LTS | node-ip-address | no fix listed | UBUNTU-CVE-2026-111997 |
| Ubuntu:26.10 | node-ip-address | no fix listed | UBUNTU-CVE-2026-111997 |
| npm | ip-address | 10.7.4 | GHSA-rxp7-6hxx-x8q5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| beaugunderson | ip-address | 0 – before 10.7.4 |
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N