Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
cleanstart/npm before 10 mishandles IP address data
published 5 days ago
Summary
Versions of cleanstart/npm earlier than 10 do not correctly process IP address information, which could cause software errors or expose the system to manipulation. This may affect any application that relies on this package for handling network addresses. Update cleanstart/npm to version 10 or newer to resolve the issue.
What to do
- Update cleanstart npm to version 12.2.0-r3.
- Update cleanstart npm to version 11.19.1-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | npm |
< 12.2.0-r3 < 11.19.1-r2 Fix: upgrade to 12.2.0-r3
|
Original advisory text
ip-address before 10
CVE-2026-111997 affects multiple packages. ip-address before 10. See references for individual vulnerability details.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-KD56455 · OSV
Track software like this
Free during beta