[Bug]: ip-address 10.7.1 is inside GHSA-rxp7-6hxx-x8q5 (moderate) #7640

Client or integration

Other

Area

Installation or packaging

Summary

bun audit reports moderate GHSA-rxp7-6hxx-x8q5 on resolved ip-address@10.7.1. bun run audit:high stays green because the finding is below high. The advisory covers <=10.7.3. This was observed while clearing the high-severity gate for #7638 and is outside that fix.

Reproduction

1. Check out dev at 306a88e08 (or the audit-pin branch cursor/audit-high-zod-body-parser-858f).
2. bun install
3. bun audit
4. Observe ip-address@10.7.1 (@modelcontextprotocol/sdk > express-rate-limit > ip-address): Address6 matches a zone identifier in quadratic time (<=10.7.3).
5. bun run audit:high exits 0 and does not mention this advisory.

package.json overrides["ip-address"] is ^10.4.0, and bun.lock resolves 10.7.1. npm ip-address latest at filing was 10.7.4. This report does not change that override.

Version

dev 306a88e08 (package.json version 2.93.0)

Operating system

Linux 6.12 (cloud agent), Bun 1.4.4

Provider and model

No response

Logs or error output

ip-address@10.7.1
  @modelcontextprotocol/sdk > express-rate-limit > ip-address
  moderate: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process (<=10.7.3) - https://github.com/advisories/GHSA-rxp7-6hxx-x8q5

Screenshots and supporting files

Related release blocker (high only): #7638

Redacted configuration

No response

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.