Hi,

The following vulnerability was published for node-ip-address.

CVE-2026-111997[0]:
| ip-address before 10.7.4 allows a denial of service (CPU consumption
| from quadratic complexity, and application stall) via many %
| characters in input reaching a function call that uses the Address6
| constructor.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111997
https://www.cve.org/CVERecord?id=CVE-2026-111997
[1] https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1151933 in node-ip-address reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-ip-address/-/commit/8726265c3760a7422dad1d1458363f9ea5dc3600

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1151933

Hello,

Bug #1151933 in node-ip-address reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-ip-address/-/commit/8726265c3760a7422dad1d1458363f9ea5dc3600

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1151933

We believe that the bug you reported is fixed in the latest version of
node-ip-address, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151933@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-ip-address package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 24 Oct 2026 21:55:55 +0200
Source: node-ip-address
Architecture: source
Version: 10.7.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1151933
Changes:
 node-ip-address (10.7.4-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version (Closes: #1151933, CVE-2026-111997)
   * Skip "docs check and commit gate" tests, they need git and
     node_modules/.bin/tsx
Checksums-Sha1:
 bb7dbd8ade321d6302b12b19dbf13d56abbd53a4 2194 node-ip-address_10.7.4-1.dsc
 7347e70ef8128707fd9368d31aaf987d4e4eec93 142796 node-ip-address_10.7.4.orig.tar.gz
 3faff3ae4f6a82ed4b5909cd78c126eb6722b916 3624 node-ip-address_10.7.4-1.debian.tar.xz
Checksums-Sha256:
 a3d354a3a84dd5016901a916c4bae25f58a12767a84fabdff2d8e2ceb0f14897 2194 node-ip-address_10.7.4-1.dsc
 2a7fdefd8b131a07db19cfeedb565b7f2433c7ba9c866fddfcad5bbdc0131f20 142796 node-ip-address_10.7.4.orig.tar.gz
 e342b98a633536ffb4e88f66463dd34020494c62fbc44841b6f46ed997909900 3624 node-ip-address_10.7.4-1.debian.tar.xz
Files:
 3f87a3439798e2bd829388072fd92ba5 2194 javascript optional node-ip-address_10.7.4-1.dsc
 7e3d645f3841798d6fd19cfb92318c0a 142796 javascript optional node-ip-address_10.7.4.orig.tar.gz
 05b7a1b656f1c41b97083648aaaf021d 3624 javascript optional node-ip-address_10.7.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrdESMACgkQ9tdMp8mZ
7uknmxAAjt9u+TnujOgmh+hfdVeq5UeR1pd9DX6OQD/29lCuWuf57ZUs88cphdTY
vTfXsTK4tdyN7P799mkrmFeyNroP2IkaNmtzCL30ITY+uId53N4XtPWMjqOvGfWd
YxAyvdVQmPxCezDoxkj2dDGgc4dzjVxegtPhHWGGmX/oWqdHGXQ4rLKoT3mhiwU/
3mgbKVF8B9x6ggYYOILZvjewDtydp/voOviA5uxZzM/rGcC1zsZxJ+WjHL02SHoD
EqwpSHVZ00xg4N6VIhQmuPxPK8HUWyb0+DF2ahjHf6aR0wQCqYl/LWLJ0a1ydZhT
8sepnwN7RdraoA43I4NF0izTWBb/KZzXDz8HaELeKI5vf6OnDbeuo58gcu3ABHVs
Ki6QSQvvXcYSfULHYQ5qZVOsO0IW+c8QqdsibcyfL0kfxlSSY4uQRjmh7wpl8ACT
sNe2XjkUPIKk+itQFf6xkKhyNLpCo9VfhyEJ4w/cSFqdWbsgb93nsVGIPrK/Ni/f
rBap9vorDdWptiWvBQBWf5nZ3p9YLu7BgMLvybuLlP861F+84ocnQMMxn8nPblaB
uZCl6GE32g9suGTruppt2c9tIUaI/R5kFwVQsbiVkhrLgxiBgdSzNVpXXdyAHmDd
o5olpTHskGK8TSkE9tNjN+++s4GLhoUQrKE8blmrH8W4CKi23Do=
=tiMn
-----END PGP SIGNATURE-----