CVE-2026-101911: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ip-addressto a version that resolves this vulnerability.Fixed in 10.7.1
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications are materially exposed only if they accept a very large attacker-controlled field and pass it to Address6 parsing without enforcing a length limit first. Typical URL and header limits, as well as common body-parser defaults, generally limit exposure and typically do not permit 32 MiB fields.
Which library calls can trigger the problem?
The affected entry points include Address6.isValid and Address6 construction paths that reach the IPv6 parse code. Supplying an unbounded invalid string to those paths can cause oversized diagnostic construction.
What behavior should responders expect from oversized input?
Megabyte-scale input can synchronously stall the process and consume substantial transient memory. Around 16 MiB, parsing can throw an invalid string length exception; around 32 MiB, it can terminate the process.
What mitigation is available if an immediate upgrade is not possible?
Apply a strict maximum length to attacker-controlled values before calling Address6.isValid or constructing an Address6 object. This prevents the unbounded diagnostic expansion that causes the stall or crash.
What version contains the fix?
The issue is fixed in ip-address version 10.7.1.