ETK-2026-3097Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3097",
  "cve_id": null,
  "display_id": "ETK-2026-3097",
  "ghsa_id": "GHSA-qf89-6xm4-66wm",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Multi-page image memory corruption in ipx",
  "summary": "ipx can corrupt process memory when decoding attacker-controlled multi-page image sources. An unauthenticated requester may crash the service and could potentially execute code with the ipx process's permissions when the deployment accepts untrusted local or remote image sources.",
  "mitigation": "Upgrade ipx to 4.1.0, 3.1.3, or 2.1.2, as appropriate for the maintained release line. Until upgrading, accept only operator-controlled sources, disable unrestricted remote domains, and configure programmatic use to avoid animated or multi-page decoding.",
  "vendor": "npm",
  "product": "IPx",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 3.1.3"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.1.3"
      ],
      "package_name": "ipx",
      "purl": "pkg:npm/ipx"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, < 2.1.2",
        ">= 3.0.0, < 3.1.3",
        ">= 4.0.0-0, < 4.1.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "2.1.2",
        "3.1.3",
        "4.1.0"
      ],
      "package_name": "ipx",
      "purl": "pkg:npm/ipx"
    }
  ],
  "cwes": [
    20
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 28.536030383333333,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-30T16:21:50+00:00",
      "days": -0.2248954914699074,
      "is_lower_bound": true,
      "measured_at": "2026-10-30T21:45:41.065153+00:00",
      "url": "https://github.com/unjs/ipx/security/advisories/GHSA-qf89-6xm4-66wm"
    }
  }
}