Live › vulnerability › GHSA-p3hm-x653-5rc6
Go to dashboardThe npm package ip-address has a regex in its Address6 parsing that runs in quadratic time on zone identifiers, so one long input with many % characters can stall the Node.js process. An attacker who can reach a code path that passes untrusted text into Address6 can cause CPU exhaustion and application stall.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ip-address | npm | <= 10.7.3 | – |
npm ls ip-address to see which versions are installed, including transitive copies10.7.3 as affected10.7.4 or later, per the original description; the withdrawn advisory itself names no fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-rxp7-6hxx-x8q5. This link is maintained to preserve external references.
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
This page as .md · .json · in your agent: get_signal("GHSA-p3hm-x653-5rc6")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.