Every CVE Search/ Get API key

CVE-2026-101911

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

6.3 MediumFix available

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.38%Up 0.1 points since Sep 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.

Record
CVE-2026-101911
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
EUVDEUVD-2026-88395 6.3

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.

Record
EUVD-2026-88395
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-h3mg-xc3c-68pw 6.3

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

Summary

new Address6() and Address6.isValid() place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte <span class="parse-error">, so the work and the memory scale with the input rather than with an address. A 1 MiB string of ! costs about 110 MB and 70 ms of synchronous work, 8 MiB costs about 800 MB and half a second, 16 MiB throws a RangeError in place of the documented AddressError, and 32 MiB aborts the Node process. isValid() builds the diagnostic and discards it, so a caller that only asks whether a string is valid pays the full price.

An application that validates an attacker-supplied string with these methods can be stalled or crashed by a single oversized request. This is a crash on input that should have been rejected cleanly, which SECURITY.md lists as in scope.

Details

parse() in src/ipv6.ts checks for characters outside [0-9a-f:/%] and, on finding any, throws an AddressError whose parseMessage is the whole input with each offending character wrapped:

const badCharacters = address.match(constants6.RE_BAD_CHARACTERS);

if (badCharacters) {
  throw new AddressError(
    `Bad character${badCharacters.length > 1 ? 's' : ''} detected in address: ${badCharacters.join('')}`,
    address.replace(constants6.RE_BAD_CHARACTERS, '<span class="parse-error">$1</span>'),
  );
}

RE_BAD_CHARACTERS is /([^0-9a-f:/%])/gi. For an input made entirely of punctuation the match allocates one string per character, the join copies them all into the message, and the replace produces a string 34 times the input. Nothing before this point looks at the length: the constructor strips a CIDR suffix and a zone identifier and hands the rest to parse(). The RE_BAD_ADDRESS branch below it builds its diagnostic the same way at about a third of the ratio, for input in the hex-and-colon alphabet such as fffff: repeated.

parse() is reached only through the constructor, so every entry point that constructs an Address6 from a string it has not already bounded is affected: new Address6(), isValid(), both arguments of fromAddressAndMask() and fromAddressAndWildcardMask(), fromWildcard(), and the prefix argument of fromAddress4Nat64() and toAddress4Nat64(). fromURL() admits only hex, colons, and dots in a host, so it reaches the RE_BAD_ADDRESS branch and not the other. fromArpa() caps its input at 32 nibbles before constructing anything, and fromBigInt(), fromByteArray(), and fromAddress4() build the string themselves, so those are unaffected.

The replace is where size becomes fatal. V8 caps a string at 2^29 - 24 characters, so past 16 MiB of input the replace throws RangeError: Invalid string length rather than the AddressError callers catch; isValid() swallows it, but a constructor call guarded by instanceof AddressError does not. Past 32 MiB the replacement builder's internal array exceeds its maximum size and V8 aborts the process with Fatal JavaScript invalid size error, which no try/catch intercepts.

Affected versions

<= 10.7.0. The diagnostic has had this shape since the parser was written, so every release is affected.

Impact

Address6.isValid() on N bytes of !, measured on node 24.19.0:

| Input | Wall time | Transient heap | Outcome | |---|---|---|---| | 16 KiB | 1 ms | 1 MB | false | | 1 MiB | 73 ms | 112 MB | false | | 8 MiB | 464 ms | 784 MB | false | | 16 MiB | | | RangeError: Invalid string length from the constructor; isValid() returns false | | 32 MiB | | | the process aborts |

The parse is synchronous, so the event loop is blocked for the whole of the wall time and nothing else on that process is served. The heap is transient and is reclaimed after the call returns, so memory does not accumulate across requests; the abort at 32 MiB is a single…

Record
GHSA-h3mg-xc3c-68pw
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
NVD 6.3

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.

Record
CVE-2026-101911
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSV 6.3

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.

Record
CVE-2026-101911
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2026-101911 6.3

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.

Record
DEBIAN-CVE-2026-101911
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 14 moreShow less
OSVGHSA-h3mg-xc3c-68pw 6.3

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

Summary

new Address6() and Address6.isValid() place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte <span class="parse-error">, so the work and the memory scale with the input rather than with an address. A 1 MiB string of ! costs about 110 MB and 70 ms of synchronous work, 8 MiB costs about 800 MB and half a second, 16 MiB throws a RangeError in place of the documented AddressError, and 32 MiB aborts the Node process. isValid() builds the diagnostic and discards it, so a caller that only asks whether a string is valid pays the full price.

An application that validates an attacker-supplied string with these methods can be stalled or crashed by a single oversized request. This is a crash on input that should have been rejected cleanly, which SECURITY.md lists as in scope.

Details

parse() in src/ipv6.ts checks for characters outside [0-9a-f:/%] and, on finding any, throws an AddressError whose parseMessage is the whole input with each offending character wrapped:

const badCharacters = address.match(constants6.RE_BAD_CHARACTERS);

if (badCharacters) {
  throw new AddressError(
    `Bad character${badCharacters.length > 1 ? 's' : ''} detected in address: ${badCharacters.join('')}`,
    address.replace(constants6.RE_BAD_CHARACTERS, '<span class="parse-error">$1</span>'),
  );
}

RE_BAD_CHARACTERS is /([^0-9a-f:/%])/gi. For an input made entirely of punctuation the match allocates one string per character, the join copies them all into the message, and the replace produces a string 34 times the input. Nothing before this point looks at the length: the constructor strips a CIDR suffix and a zone identifier and hands the rest to parse(). The RE_BAD_ADDRESS branch below it builds its diagnostic the same way at about a third of the ratio, for input in the hex-and-colon alphabet such as fffff: repeated.

parse() is reached only through the constructor, so every entry point that constructs an Address6 from a string it has not already bounded is affected: new Address6(), isValid(), both arguments of fromAddressAndMask() and fromAddressAndWildcardMask(), fromWildcard(), and the prefix argument of fromAddress4Nat64() and toAddress4Nat64(). fromURL() admits only hex, colons, and dots in a host, so it reaches the RE_BAD_ADDRESS branch and not the other. fromArpa() caps its input at 32 nibbles before constructing anything, and fromBigInt(), fromByteArray(), and fromAddress4() build the string themselves, so those are unaffected.

The replace is where size becomes fatal. V8 caps a string at 2^29 - 24 characters, so past 16 MiB of input the replace throws RangeError: Invalid string length rather than the AddressError callers catch; isValid() swallows it, but a constructor call guarded by instanceof AddressError does not. Past 32 MiB the replacement builder's internal array exceeds its maximum size and V8 aborts the process with Fatal JavaScript invalid size error, which no try/catch intercepts.

Affected versions

<= 10.7.0. The diagnostic has had this shape since the parser was written, so every release is affected.

Impact

Address6.isValid() on N bytes of !, measured on node 24.19.0:

| Input | Wall time | Transient heap | Outcome | |---|---|---|---| | 16 KiB | 1 ms | 1 MB | false | | 1 MiB | 73 ms | 112 MB | false | | 8 MiB | 464 ms | 784 MB | false | | 16 MiB | | | RangeError: Invalid string length from the constructor; isValid() returns false | | 32 MiB | | | the process aborts |

The parse is synchronous, so the event loop is blocked for the whole of the wall time and nothing else on that process is served. The heap is transient and is reclaimed after the call returns, so memory does not accumulate across requests; the abort at 32 MiB is a single…

Record
GHSA-h3mg-xc3c-68pw
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVRLSA-2026:92376 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92376
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:92378 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92378
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-101911 6.3

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.

Record
UBUNTU-CVE-2026-101911
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVALSA-2026:92376 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92376
Updated
2026-11-02
OSVALSA-2026:92378 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92378
Updated
2026-11-02
OSVCLSA-2026-1790862953 No score

TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 10.7.0-tuxcare.2.

Record
CLSA-2026-1790862953
Updated
2026-11-02
OSVCLSA-2026-1790937671 No score

TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 7.1.0-tuxcare.5.

Record
CLSA-2026-1790937671
Updated
2026-11-02
OSVCLSA-2026-1791028139 No score

TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.6.

Record
CLSA-2026-1791028139
Updated
2026-11-02
OSVCLSA-2026-1792233491 No score

TuxCare security update for ip-address (3 CVEs)

TuxCare rebuilt ip-address to address 3 CVEs. Fixed in 9.0.5-tuxcare.3.

Record
CLSA-2026-1792233491
Updated
2026-11-02
OSVCLSA-2026-1792369098 No score

TuxCare security update for ip-address (4 CVEs)

TuxCare rebuilt ip-address to address 4 CVEs. Fixed in 10.5.0-tuxcare.1.

Record
CLSA-2026-1792369098
Updated
2026-11-02
OSVCLSA-2026-1792451467 No score

TuxCare security update for ip-address (6 CVEs)

TuxCare rebuilt ip-address to address 6 CVEs. Fixed in 10.1.1-tuxcare.1.

Record
CLSA-2026-1792451467
Updated
2026-11-02
OSVCLSA-2026-1792473368 No score

TuxCare security update for ip-address (3 CVEs)

TuxCare rebuilt ip-address to address 3 CVEs. Fixed in 10.5.1-tuxcare.1.

Record
CLSA-2026-1792473368
Updated
2026-11-02
OSVCLSA-2026-1792476227 No score

TuxCare security update for ip-address (7 CVEs)

TuxCare rebuilt ip-address to address 7 CVEs. Fixed in 10.1.0-tuxcare.1.

Record
CLSA-2026-1792476227
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ip-address
npm
 through 10.7.0
10.7.1
nodejs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-devel
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-docs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-libs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-nodemon
AlmaLinux:8
From an advisory covering 13 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
nodejs-packaging
AlmaLinux:8
From an advisory covering 13 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 13 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
Show 39 moreShow less
Affected packages
PackageAffectedFixed
v8-13.6-devel
AlmaLinux:8
From an advisory covering 13 CVEs
 before 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
nodejs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-docs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-libs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-nodemon
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 13 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 13 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
v8-13.6-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
ip-address
TuxCare:npm
 10.7.0-tuxcare.0 up to 10.7.0-tuxcare.2, plus listed versions
10.7.010.7.0-tuxcare.1
10.7.0-tuxcare.2
ip-address
TuxCare:npm
 7.1.0-tuxcare.0 up to 7.1.0-tuxcare.5, plus listed versions
7.1.07.1.0-tuxcare.17.1.0-tuxcare.27.1.0-tuxcare.37.1.0-tuxcare.4
7.1.0-tuxcare.5
ip-address
TuxCare:npm
 6.4.0-tuxcare.0 up to 6.4.0-tuxcare.6, plus listed versions
6.4.06.4.0-tuxcare.16.4.0-tuxcare.26.4.0-tuxcare.36.4.0-tuxcare.46.4.0-tuxcare.5
6.4.0-tuxcare.6
ip-address
TuxCare:npm
From an advisory covering 3 CVEs
 9.0.5-tuxcare.0 up to 9.0.5-tuxcare.3, plus listed versions
9.0.59.0.5-tuxcare.19.0.5-tuxcare.2
9.0.5-tuxcare.3
ip-address
TuxCare:npm
From an advisory covering 4 CVEs
 10.5.0-tuxcare.0 up to 10.5.0-tuxcare.1, plus listed versions
10.5.0
10.5.0-tuxcare.1
ip-address
TuxCare:npm
From an advisory covering 5 CVEs
 10.1.1-tuxcare.0 up to 10.1.1-tuxcare.1, plus listed versions
10.1.1
10.1.1-tuxcare.1
ip-address
TuxCare:npm
From an advisory covering 3 CVEs
 10.5.1-tuxcare.0 up to 10.5.1-tuxcare.1, plus listed versions
10.5.1
10.5.1-tuxcare.1
ip-address
TuxCare:npm
From an advisory covering 5 CVEs
 10.1.0-tuxcare.0 up to 10.1.0-tuxcare.1, plus listed versions
10.1.0
10.1.0-tuxcare.1
node-ip-address
Debian:12
 All versions, plus listed versions
10.2.0-110.2.0-210.3.1-110.4.0-110.7.2-18.1.0-28.1.0-3
 None known
node-ip-address
Debian:13
 All versions, plus listed versions
10.2.0-110.2.0-210.3.1-110.4.0-110.7.2-18.1.0-28.1.0-3
 None known
node-ip-address
Debian:14
 before 10.7.2-1, plus listed versions
10.2.0-110.2.0-210.3.1-110.4.0-18.1.0-28.1.0-3
10.7.2-1
ip-address
npm
 before 10.7.1
10.7.1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs
Rocky Linux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module+el9.8.0+40401+e24b8c95
1:24.22.1-3.module+el9.8.0+40401+e24b8c95
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
node-ip-address
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.3.0-1
 None known
node-ip-address
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.4.0-18.1.0-2
 None known
node-ip-address
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.1.0-2
 None known
node-ip-address
Ubuntu:26.10
 All versions, plus listed versions
8.1.0-310.2.0-210.3.1-110.4.0-1
 None known
node-ip-address
Ubuntu:26.04:LTS
 All versions, plus listed versions
8.1.0-28.1.0-3
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-101911 is a medium vulnerability (CVSS 6.3) in Beaugunderson Ip-address, published September 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in ip-address 10.7.1.

References

Show 50 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open