Security Advisory

CVE-2026-111997: ip-address npm DoS (pending analysis)

Last updated: 2026-10-20

CVE-2026-111997

Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2026-111997 is a denial-of-service weakness in the ip-address npm package; NVD has not yet completed its own CVSS scoring or CPE analysis and it is not in the CISA KEV catalog, so this page is held as noindex until that analysis is published.

Vulnerability summary

N/A

Not yet scored

0.3%

EPSS score (FIRST)

CISA KEV catalog

2026-10-18

Published

Vulnerability ID: CVE-2026-111997 · Source: NVD

Affected components

Component	CPE	Version range
ip-address (npm package)	pkg:npm/ip-address	<= 10.7.3 (fixed in 10.7.4); per the GitHub Security Advisory, not yet a published NVD CPE applicability statement

What this means

CVE-2026-111997 is tracked by NVD with the status "Awaiting Analysis" as of 2026-10-19: NVD has recorded the CVE and its CNA-submitted description, but has not yet published its own CVSS base score or a CPE applicability statement for the affected package (NVD).

The submitting CNA describes the flaw as a denial of service from CPU consumption caused by quadratic-complexity parsing: input containing many '%' characters reaching the Address6 constructor can stall the application, and reports a CVSS v4.0 score of 6.3 (medium) — a CNA-reported figure, not an NVD-confirmed one (NVD).

The referenced GitHub Security Advisory for the ip-address package lists versions up to and including 10.7.3 as affected, fixed in 10.7.4 (GitHub Security Advisory GHSA-rxp7-6hxx-x8q5).

As of 2026-10-19 this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and FIRST's EPSS score is low (0.0025, 15.7th percentile) (CISA KEV, FIRST EPSS).

Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published.

How to fix this class of issueThis advisory does not name a weakness class we have a dedicated guide for yet. The fix is usually the vendor patch or firmware update referenced above — our guide below covers how to plan and verify that: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

NVD status is "Awaiting Analysis" with no NVD-published CVSS score or CPE configuration as of 2026-10-19. — NVD
The submitting CNA reports CVSS v4.0 6.3 (medium) for a quadratic-complexity DoS in the Address6 constructor. — NVD
Affected ip-address npm package versions are <= 10.7.3, fixed in 10.7.4. — GitHub Security Advisory
Not present in the CISA KEV catalog as of 2026-10-19. — CISA KEV
EPSS score is 0.0025 (15.7th percentile) as of 2026-10-19. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan report Track this CVE Chat with David on WhatsApp

Talk to an expert

Huy Nguyen (David)

Founder & CEO, Netbase JSC

WhatsApp [email protected]

Related advisories

CVE-2026-15952: ABB PCM600 Privesc (pending analysis)CVE-2026-15952: ABB PCM600 scheduler flaw allows local privilege escalation. NVD analysis incomplete, so this page stays noindex pending review.CVE-2026-16436: Mitsubishi Electric GENESIS/ICONICS Suite Fixed Challenge-Response Bypass (pending)CVE-2026-16436: the SCADA/HMI unlock challenge-response in Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite and related products is common to all users and fixed, letting a remote attacker unlock the system. Vendor and CISA scoring; NVD analysis pending.CVE-2026-16437: Mitsubishi Electric/ICONICS GENESIS Weak Password Recovery (pending)CVE-2026-16437: a local admin can tamper with the challenge-response file in Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite and related products to unlock the system. Vendor/CISA data; NVD analysis pending.