{"id":"GHSA-p3hm-x653-5rc6","kind":"vulnerability","aliases":["GHSA-p3hm-x653-5rc6"],"related":[],"title":"Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-rxp7-6hxx-x8q5. This link is maintained to preserve external references.\n\n## Original Description\nip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","summary":"The npm package ip-address has a regex in its Address6 parsing that runs in quadratic time on zone identifiers, so one long input with many % characters can stall the Node.js process. An attacker who can reach a code path that passes untrusted text into Address6 can cause CPU exhaustion and application stall.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ip-address","fixed":[],"affected":"<= 10.7.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-1333","ip-address","node.js","npm","package"],"not_affected_if":["ip-address-not-installed","no-untrusted-input-to-address6"],"how_to_check":"Run npm ls ip-address to see which versions are installed, including transitive copies.\nFlag any version at or below 10.7.3 as affected.","fix":"Upgrade ip-address to 10.7.4 or later, per the original description; the withdrawn advisory itself names no fixed version.\nThe duplicate GHSA-rxp7-6hxx-x8q5 is the live advisory to follow.","status":"withdrawn","published_at":"2026-10-18T03:32:37+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:15:39+00:00","updated_at":"2026-10-23T20:15:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:15:39Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade ip-address to 10.7.4 or later, per the original description; the withdrawn advisory itself names no fixed version.\nThe duplicate GHSA-rxp7-6hxx-x8q5 is the live advisory to follow.","summary":"The npm package ip-address has a regex in its Address6 parsing that runs in quadratic time on zone identifiers, so one long input with many % characters can stall the Node.js process. An attacker who can reach a code path that passes untrusted text into Address6 can cause CPU exhaustion and application stall.","category":"package","who_cares":["npm","node.js","ip-address"],"confidence":0.7,"analyst_note":"Advisory is withdrawn as a duplicate; confirm fixed version and details on GHSA-rxp7-6hxx-x8q5 at https://github.com/advisories/GHSA-rxp7-6hxx-x8q5.","how_to_check":"Run npm ls ip-address to see which versions are installed, including transitive copies.\nFlag any version at or below 10.7.3 as affected.\nunknown","needs_analyst":true,"not_affected_if":["no-untrusted-input-to-address6","ip-address-not-installed"],"severity_if_unknown":"medium"},"cost_usd":0.000425,"input_tokens":2109,"output_tokens":429,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1333':42B '10.7.4':135C '5rc6':32A,37A '6hxx':119C 'address':5A,40A,45B,54B,133C 'address6':6A,60B,95B,161C 'advisori':2A,104C,106C 'ahead':14A 'allow':19A,136C 'applic':101B,147C 'attack':83B 'call':157C 'caus':97B 'charact':76B,151C 'code':88B 'complex':145C 'constructor':162C 'consumpt':142C 'cpu':98B,141C 'cwe':41B 'denial':138C 'descript':130C 'duplic':1A,103C,114C 'exhaust':99B 'extern':127C 'function':156C 'ghsa':29A,34A,117C 'ghsa-p3hm-x653-5rc6':28A,33A 'ghsa-rxp7-6hxx-x8q5':116C 'identifi':10A,69B 'input':73B,153C 'ip':4A,39A,44B,53B,132C 'ip-address':3A,38A,43B,52B,131C 'length':17A 'limit':18A 'link':122C 'long':22A,72B 'maintain':124C 'mani':75B,150C 'match':7A 'node.js':46B,80B 'npm':47B,50B 'one':71B 'origin':129C 'p3hm':30A,35A 'packag':48B,51B 'pars':61B 'pass':91B 'path':89B 'preserv':126C 'process':27A,81B 'quadrat':12A,65B,144C 'reach':86B,154C 'refer':128C 'regex':57B 'run':63B 'rxp7':118C 'servic':140C 'singl':21A 'stall':25A,78B,102B,148C 'string':23A 'text':93B 'time':13A,66B 'untrust':92B 'use':159C 'via':149C 'withdrawn':109C 'x653':31A,36A 'x8q5':120C 'zone':9A,68B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T03:32:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-p3hm-x653-5rc6","url":"https://github.com/advisories/GHSA-p3hm-x653-5rc6","severity":"medium","published_at":"2026-10-18T03:32:37+00:00","modified_at":"2026-10-22T16:19:30+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}