CVE-2026-111997 in ip-address
Summary
by MITRE • 10/18/2026
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in ip-address versions prior to 10.7.4 represents a significant reliability risk for applications relying on this JavaScript library for IP address manipulation. The core issue stems from an inefficient implementation of string parsing logic, specifically within the function call that utilizes the Address6 constructor. When processing IPv6 addresses or related input strings, the parser fails to optimize its handling of specific character sequences, leading to a catastrophic degradation in performance under certain conditions. This is not merely a minor latency issue but a structural flaw in how the library processes malformed or excessively complex inputs, allowing an attacker to trigger resource exhaustion with minimal effort.
The technical root cause lies in the quadratic complexity associated with parsing input strings that contain many percent characters. In computer science terms, this indicates that as the length of the malicious input increases linearly, the time required for the parser to complete its operation grows exponentially or quadratically rather than proportionally. This behavior is characteristic of algorithms that perform redundant checks or nested loops without proper bounds checking or early exit conditions when encountering specific delimiters like the percent sign, which is often used in URL encoding but can be abused here to force repeated parsing cycles. The Address6 constructor, responsible for initializing IPv6 address objects, executes this flawed logic, causing it to hang indefinitely on inputs designed to exploit this inefficiency.
From an operational perspective, the impact of this vulnerability is severe due to its potential for Denial of Service attacks. Because Node.js and many JavaScript runtimes operate on a single-threaded event loop, any function that blocks or consumes excessive CPU cycles will stall the entire application thread. This means that a single request containing a string with numerous percent characters can freeze the server, preventing it from handling legitimate traffic. The result is a complete service outage for all users connected to the affected system until the process times out or crashes, which may take an unacceptably long time given the quadratic nature of the processing load. This aligns directly with CWE-400, Uncontrolled Resource Consumption, where insufficient attention is paid to limiting resource usage in response to external input.
Furthermore, this vulnerability can be categorized under CWE-732 and relates closely to ATT&CK technique T1496, Network Service Scanning or Denial of Service via application layer attacks. Attackers do not need sophisticated tools; a simple HTTP request with a crafted payload is sufficient to trigger the condition. The lack of input validation regarding string length or character composition allows this abuse vector to remain open in production environments that rely on ip-address for parsing user-supplied data, such as API endpoints accepting IP addresses or network configuration inputs.
Mitigation requires an immediate upgrade to version 10.7.4 or later, where the developers have addressed these performance bottlenecks by optimizing the parsing algorithms and implementing stricter input constraints. For organizations unable to patch immediately due to dependency conflicts, temporary workarounds should include implementing strict length limits on incoming IP address fields at the network perimeter using Web Application Firewalls (WAF). Additionally, application-level validation should be enforced to reject inputs containing excessive special characters or exceeding a reasonable character count before they reach the ip-address library. Regular security audits of third-party dependencies are essential to identify such algorithmic inefficiencies that can lead to critical availability issues in modern web applications.