Your message dated Sat, 24 Oct 2026 20:42:37 +0000
with message-id <[email protected]>
and subject line Bug#1151933: fixed in node-ip-address 10.7.4-1
has caused the Debian Bug report #1151933,
regarding node-ip-address: CVE-2026-111997
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151933: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151933
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-ip-address
Version: 10.7.2-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for node-ip-address.
CVE-2026-111997[0]:
| ip-address before 10.7.4 allows a denial of service (CPU consumption
| from quadratic complexity, and application stall) via many %
| characters in input reaching a function call that uses the Address6
| constructor.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-111997
https://www.cve.org/CVERecord?id=CVE-2026-111997
[1]
https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-ip-address
Source-Version: 10.7.4-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-ip-address, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-ip-address package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 21:55:55 +0200
Source: node-ip-address
Architecture: source
Version: 10.7.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1151933
Changes:
node-ip-address (10.7.4-1) unstable; urgency=medium
.
* Team upload
* New upstream version (Closes: #1151933, CVE-2026-111997)
* Skip "docs check and commit gate" tests, they need git and
node_modules/.bin/tsx
Checksums-Sha1:
bb7dbd8ade321d6302b12b19dbf13d56abbd53a4 2194 node-ip-address_10.7.4-1.dsc
7347e70ef8128707fd9368d31aaf987d4e4eec93 142796
node-ip-address_10.7.4.orig.tar.gz
3faff3ae4f6a82ed4b5909cd78c126eb6722b916 3624
node-ip-address_10.7.4-1.debian.tar.xz
Checksums-Sha256:
a3d354a3a84dd5016901a916c4bae25f58a12767a84fabdff2d8e2ceb0f14897 2194
node-ip-address_10.7.4-1.dsc
2a7fdefd8b131a07db19cfeedb565b7f2433c7ba9c866fddfcad5bbdc0131f20 142796
node-ip-address_10.7.4.orig.tar.gz
e342b98a633536ffb4e88f66463dd34020494c62fbc44841b6f46ed997909900 3624
node-ip-address_10.7.4-1.debian.tar.xz
Files:
3f87a3439798e2bd829388072fd92ba5 2194 javascript optional
node-ip-address_10.7.4-1.dsc
7e3d645f3841798d6fd19cfb92318c0a 142796 javascript optional
node-ip-address_10.7.4.orig.tar.gz
05b7a1b656f1c41b97083648aaaf021d 3624 javascript optional
node-ip-address_10.7.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrdESMACgkQ9tdMp8mZ
7uknmxAAjt9u+TnujOgmh+hfdVeq5UeR1pd9DX6OQD/29lCuWuf57ZUs88cphdTY
vTfXsTK4tdyN7P799mkrmFeyNroP2IkaNmtzCL30ITY+uId53N4XtPWMjqOvGfWd
YxAyvdVQmPxCezDoxkj2dDGgc4dzjVxegtPhHWGGmX/oWqdHGXQ4rLKoT3mhiwU/
3mgbKVF8B9x6ggYYOILZvjewDtydp/voOviA5uxZzM/rGcC1zsZxJ+WjHL02SHoD
EqwpSHVZ00xg4N6VIhQmuPxPK8HUWyb0+DF2ahjHf6aR0wQCqYl/LWLJ0a1ydZhT
8sepnwN7RdraoA43I4NF0izTWBb/KZzXDz8HaELeKI5vf6OnDbeuo58gcu3ABHVs
Ki6QSQvvXcYSfULHYQ5qZVOsO0IW+c8QqdsibcyfL0kfxlSSY4uQRjmh7wpl8ACT
sNe2XjkUPIKk+itQFf6xkKhyNLpCo9VfhyEJ4w/cSFqdWbsgb93nsVGIPrK/Ni/f
rBap9vorDdWptiWvBQBWf5nZ3p9YLu7BgMLvybuLlP861F+84ocnQMMxn8nPblaB
uZCl6GE32g9suGTruppt2c9tIUaI/R5kFwVQsbiVkhrLgxiBgdSzNVpXXdyAHmDd
o5olpTHskGK8TSkE9tNjN+++s4GLhoUQrKE8blmrH8W4CKi23Do=
=tiMn
-----END PGP SIGNATURE-----
pgpicfYXzHsgV.pgp
Description: PGP signature
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
