CVE-2026-111997: ip-address Address6 quadratic regex denial of service

CVE-2026-111997 · Severity: medium · CVSS 4 · Published 2026-10-18

ip-address is a JavaScript library for parsing and validating IP addresses. When an application uses it to validate untrusted input containing many percent characters followed by a line break, the library performs redundant regex matching that consumes CPU in a quadratic time pattern, blocking the entire application from processing other requests. An attacker can send specially crafted input to cause the application to stall for seconds.

Technologies: Beaugunderson Ip-Address, ip-address (npm). Vendors: Beaugunderson, npm.

Quick answers

Is CVE-2026-111997 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111997 being exploited in the wild.
How severe is CVE-2026-111997?
Medium severity, with a CVSS score of 4, published 18 October 2026.
Which products and versions are affected?
Beaugunderson Ip-Address before 10.7.4; ip-address (npm) <= 10.7.3, SEMVER:introduced=0,fixed=10.7.4.
Is there a fix for CVE-2026-111997?
Yes. ip-address (npm): upgrade to 10.7.4 or later. Until then: If immediate upgrading is not possible, reject candidate addresses longer than 64 characters before passing them to the Address6 constructor or isValid() method. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111997 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-111997?
Check whether you run Beaugunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ip-address (npm): upgrade to 10.7.4 or later
    npm install ip-address@10.7.4

If immediate upgrading is not possible, reject candidate addresses longer than 64 characters before passing them to the Address6 constructor or isValid() method.

Technical details

The Address6 constructor and related methods (isValid, fromAddressAndMask, fromAddressAndWildcardMask, fromAddress4Nat64, toAddress4Nat64) use a regex pattern /%.*$/ to strip zone identifiers without anchoring or preventing line terminator matching. When a string contains N percent characters followed by a newline, the regex engine attempts a match at each percent character position, causing O(N²) complexity. An attacker can supply input via URL-encoded request bodies or direct host parameters to trigger unbounded synchronous blocking.

Affected products

  • beaugunderson ip-address before 10.7.4

Identifiers

  • CVE-2026-111997
  • GHSA-rxp7-6hxx-x8q5

Timeline

  • 2026-10-11: disclosed
  • 2026-10-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.