{"id":"GHSA-p3hm-x653-5rc6","title":"Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","summary":"Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","severity":"medium","cwe":["CWE-1333"],"vendor":"ip-address","product":"ip-address","ecosystem":"npm","affected":["ip-address <= 10.7.3"],"published":"2026-10-18","updated":"2026-10-22","sourceUpdated":"2026-10-22T16:19:30Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-p3hm-x653-5rc6","references":[{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997"},{"url":"https://github.com/advisories/GHSA-p3hm-x653-5rc6"}],"tags":["ghsa","npm"],"ingestedAt":"2026-10-22T22:00:50.256Z","slug":"GHSA-p3hm-x653-5rc6","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-rxp7-6hxx-x8q5. This link is maintained to preserve external references.\n\n## Original Description\nip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.\n\n## Affected packages\n\n- `ip-address <= 10.7.3`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}