CVE-2026-111997 with a CVSS score of 6.3 is a regular expression denial of service flaw in the ip-address npm package, specifically in Address6 zone identifier handling. It affects ip-address versions <= 10.7.3, including 9.0.5. The Address6 constructor and Address6.isValid remove a zone identifier with the unanchored pattern /%.*$/ before applying the 45-character length limit. When attacker-controlled input contains many percent characters followed by a line terminator, the regex engine repeatedly starts matching at each percent and scans to the terminator before failing, causing processing time proportional to the square of input length. The attack can be triggered by attacker-supplied input passed to validation methods, but requires a line terminator after the percent characters, so it can arrive through request bodies or percent-encoded URL components rather than ordinary HTTP header values. A single long string can block the synchronous event loop, stalling the process and preventing other work. The input is ultimately rejected with the correct AddressError, but the cost of reaching rejection creates availability impact, potentially causing service degradation or denial of service for applications that validate such input.
We recommend you to update ip-address to version 10.7.4.[/subscribe_to_unlock_form]
CVE-2026-111997 with a CVSS score of 6.3 is a regular expression denial of service flaw in the ip-address npm package, specifically in Address6 zone identifier handling. It affects ip-address versions <= 10.7.3, including 9.0.5. The Address6 constructor and Address6.isValid remove a zone identifier with the unanchored pattern /%.*$/ before applying the 45-character length limit. When attacker-controlled input contains many percent characters followed by a line terminator, the regex engine repeatedly starts matching at each percent and scans to the terminator before failing, causing processing time proportional to the square of input length. The attack can be triggered by attacker-supplied input passed to validation methods, but requires a line terminator after the percent characters, so it can arrive through request bodies or percent-encoded URL components rather than ordinary HTTP header values. A single long string can block the synchronous event loop, stalling the process and preventing other work. The input is ultimately rejected with the correct AddressError, but the cost of reaching rejection creates availability impact, potentially causing service degradation or denial of service for applications that validate such input.
We recommend you to update ip-address to version 10.7.4.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]