ip-address has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 5.3 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Weakness classes
Products
- ip-address 3
Worst active — by depth score
CVE-2026-111997Medium· 5.3ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process41GHSA-p3hm-x653-5rc6MediumDuplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process28CVE-2026-69198Mediumip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript28
ip-address vulnerabilities
CVEs affecting ip-address, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-111997Medium· 5.3PoCip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
GHSA-p3hm-x653-5rc6MediumDuplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
CVE-2026-69198Mediumip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's ow…