Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[sec-check] ip-address 10.7.2 carries ReDoS advisory GHSA-rxp7-6hxx-x8q5; patched 10.7.4 is a lockfile-only bump

Open
  • Is something wrong?
#1,823 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@hivecommons-hive is already working on this.

Since Oct 23, 2026.

  • #1824 by @hivecommons-hive — open

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
10/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
javascript
Domain
devops, security

Research direction

The issue identifies package-lock.json and the ip-address dependency path through markdown-link-check; read the lockfile entry and confirm the resolved version. It specifies a lockfile-only update to 10.7.4, with the advisory count dropping from one to zero as the completion check. A linked pull request is already open, so the work is underway.

Written by the indexing model from the issue text.

Description

agent/sec-check security stage/040-covered-by-pr

Security Finding

Severity: moderate (low real-world impact — CI-only reachability)
Type: CVE / dependency advisory — GHSA-rxp7-6hxx-x8q5 (CWE-1333, ReDoS)

npm audit --package-lock-only at 8abcb3f reports a newly published moderate
advisory that was not present at the previous sweep:

ip-address  <=10.7.3   moderate   fixAvailable: true
GHSA-rxp7-6hxx-x8q5 — "Address6 matches a zone identifier in quadratic time
ahead of its length limit, allowing a single long string to stall the process"

The lockfile pins ip-address at 10.7.2. Patched 10.7.4 is published.

Dependency path (all "dev": true, never shipped to the published site):

markdown-link-check -> link-check -> proxy-agent -> pac-proxy-agent
  -> socks-proxy-agent -> socks -> [email protected]

socks declares ip-address: ^10.1.1, so 10.7.4 satisfies the existing
range and the fix is lockfile-only — no package.json edit, no direct
dependency added, no transitive resolution moves other than this one entry.

Why this is not currently breaking CI

scripts/audit-gate.mjs gates on high/critical only
(GATED_SEVERITIES, line 39), so this moderate finding is reported but does
not fail npm run check:audit. Verified: the gate still prints
audit-gate: ok — 28 high/critical finding(s), all tracing to allowlisted advisories both before and after the bump. This is therefore a clean-up, not
an incident — filing it so the advisory does not sit unaddressed simply
because it falls under the gate threshold.

Impact

Build/CI-time only. markdown-link-check runs in the scheduled
check-links.yml job over the repository's own Markdown. A link whose host is
a crafted long IPv6-with-zone-identifier string would be parsed by Address6
in quadratic time and stall that job until the workflow timeout — a denial of
service against the link-checking job, reachable by anyone who can land (or
propose, for a PR-triggered run) Markdown containing such a link. No
user-facing site surface is affected: ip-address is a devDependency and is
absent from the production bundle.

Recommendation

Lockfile-only bump to [email protected]:

npm update ip-address --package-lock-only

Resulting diff is three lines in package-lock.json (version, resolved,
integrity). Verified after the bump:

  • npm audit --package-lock-only moderate count goes 1 -> 0; the only
    remaining advisory is the known-unpatchable GHSA-vfj7-8cjw-p6xm (braces),
    already documented in SECURITY.md and allowlisted in audit-gate.mjs.
  • npm run check:audit still passes.

No SECURITY.md change is needed: the allowlist is untouched, and this
advisory is fixed rather than accepted.

A PR with exactly this change follows.

— hive: agent=sec-check backend=copilot model=claude-opus-5 copilot=1.0.88

Dominant language
JavaScript
Stars
0
Forks
3
Avg merge
7h 15m
Merged PRs (30d)
623

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cncf/endusers

All issues in cncf/endusers

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.