CVE-2026-101911 in ip-address
Summary
by MITRE • 09/28/2026
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The ip-address library serves as a foundational utility for parsing and manipulating IPv4 and IPv6 addresses within JavaScript environments, providing essential functionality for network-related applications. However, prior to version 10.7.1, the implementation of the Address6 constructor, the isValid validation method, and the underlying parse logic in src/ipv6.ts contained a significant input handling flaw. Specifically, these entry points failed to enforce strict length constraints on incoming string inputs before processing them through regular expression matching operations designed to identify invalid characters. This lack of pre-validation allows an attacker-controlled field containing unbounded or excessively long strings to trigger disproportionate resource consumption during the parsing phase.
The technical root cause lies in how the library processes input against a regex pattern intended to detect bad characters, referred to as RE_BAD_CHARACTERS. When a very large string is passed to these functions without prior length validation, the regular expression engine engages in extensive backtracking or expansion operations on invalid character sequences. This behavior leads to severe performance degradation and memory exhaustion rather than failing fast with an appropriate error message. The vulnerability effectively transforms what should be a simple input validation check into a resource-intensive operation that can destabilize the host process depending on the size of the malicious payload.
The operational impact of this flaw is primarily characterized by denial-of-service conditions, manifesting as synchronous stalls and high transient memory usage. Empirical analysis indicates that megabyte-scale fields are sufficient to cause noticeable synchronous blocking of the event loop, which can freeze application responsiveness for all concurrent users in single-threaded JavaScript environments. As the input size increases further, approximately 16 MiB triggers an invalid string length exception within the V8 engine or Node.js runtime, while inputs around 32 MiB result in complete process termination due to memory limits being exceeded. This creates a clear path for remote attackers to crash services that accept large user-controlled fields and pass them directly to IPv6 parsing functions without intermediate sanitization.
Mitigation strategies must address both the immediate software vulnerability and broader architectural input handling practices. The primary remediation is upgrading the ip-address library to version 10.7.1 or later, where these entry points have been patched to enforce appropriate length bounds before processing. In environments where an upgrade is not immediately feasible, developers should implement strict input validation at the application boundary. This includes enforcing maximum string lengths on any fields that might be passed to IPv6 parsing functions and ensuring that body parsers are configured with reasonable size limits, typically excluding fields larger than 32 MiB as noted in common defaults. Additionally, implementing timeout mechanisms for synchronous operations can help mitigate the impact of such stalls by terminating long-running requests before they exhaust system resources.
From a classification perspective, this vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption, specifically highlighting how improper input validation leads to resource exhaustion. It also relates to CWE-20, Improper Input Validation, as the core failure is the acceptance of unbounded strings without adequate length checks before processing. In terms of attack tactics, this flaw supports Denial-of-Service scenarios within the MITRE ATT&CK framework, particularly under techniques that exploit software vulnerabilities for resource exhaustion. By understanding these patterns, security teams can better identify similar flaws in other parsing libraries and enforce stricter input constraints across their JavaScript codebases to prevent synchronous stalls and memory-based crashes.