MediumFix available

DEBIAN-CVE-2026-101911

Type: advisorySource: OSV1 source record

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.

Announced 28 Sept 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-101911

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-101911

node-ip-address

Source reference: /affected/0/package/name

Affected versions: 10.2.0-1
Source reference: /affected/0/versions
10.2.0-2
Source reference: /affected/0/versions
10.3.1-1
Source reference: /affected/0/versions
10.4.0-1
Source reference: /affected/0/versions
10.7.2-1
Source reference: /affected/0/versions
8.1.0-2
Source reference: /affected/0/versions
8.1.0-3
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-ip-address

Source reference: /affected/1/package/name

Affected versions: 10.2.0-1
Source reference: /affected/1/versions
10.2.0-2
Source reference: /affected/1/versions
10.3.1-1
Source reference: /affected/1/versions
10.4.0-1
Source reference: /affected/1/versions
10.7.2-1
Source reference: /affected/1/versions
8.1.0-2
Source reference: /affected/1/versions
8.1.0-3
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-ip-address

Source reference: /affected/2/package/name

Affected versions: 10.2.0-1
Source reference: /affected/2/versions
10.2.0-2
Source reference: /affected/2/versions
10.3.1-1
Source reference: /affected/2/versions
10.4.0-1
Source reference: /affected/2/versions
8.1.0-2
Source reference: /affected/2/versions
8.1.0-3
Source reference: /affected/2/versions
Fixed versions: 10.7.2-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-ip-address",
      "purl": "pkg:deb/debian/node-ip-address?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "10.2.0-1",
      "10.2.0-2",
      "10.3.1-1",
      "10.4.0-1",
      "10.7.2-1",
      "8.1.0-2",
      "8.1.0-3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-101911.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-ip-address",
      "purl": "pkg:deb/debian/node-ip-address?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "10.2.0-1",
      "10.2.0-2",
      "10.3.1-1",
      "10.4.0-1",
      "10.7.2-1",
      "8.1.0-2",
      "8.1.0-3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-101911.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.7.2-1"
          }
        ]
      }
    ],
    "package": {
      "name": "node-ip-address",
      "purl": "pkg:deb/debian/node-ip-address?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "10.2.0-1",
      "10.2.0-2",
      "10.3.1-1",
      "10.4.0-1",
      "8.1.0-2",
      "8.1.0-3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-101911.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Related CVEs: CVE-2026-101911
Source reference: /upstream

Publisher severity

medium

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-101911 · Medium

ip-address

Event: #67668 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 21:13:37 GMT
Publisher date: Mon, 28 Sep 2026 18:17:20 GMT

Read the original announcement