# CVE-2026-111997: ip-address Address6 quadratic regex denial of service

Source: https://junglewise.ai/threats/cve-2026-111997-ip-address-before-10-7-4-allows-a-denial-of-service-cpu  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-111997 · Severity: medium · CVSS 4 · Published 2026-10-18

ip-address is a JavaScript library for parsing and validating IP addresses. When an application uses it to validate untrusted input containing many percent characters followed by a line break, the library performs redundant regex matching that consumes CPU in a quadratic time pattern, blocking the entire application from processing other requests. An attacker can send specially crafted input to cause the application to stall for seconds.

Technologies: [Beaugunderson Ip-Address](https://junglewise.ai/threats/technologies/beaugunderson-ip-address), [ip-address (npm)](https://junglewise.ai/threats/technologies/ip-address). Vendors: [Beaugunderson](https://junglewise.ai/threats/vendors/beaugunderson), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-111997 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111997 being exploited in the wild.

**How severe is CVE-2026-111997?** Medium severity, with a CVSS score of 4, published 18 October 2026.

**Which products and versions are affected?** Beaugunderson Ip-Address before 10.7.4; ip-address (npm) <= 10.7.3, SEMVER:introduced=0,fixed=10.7.4.

**Is there a fix for CVE-2026-111997?** Yes. ip-address (npm): upgrade to 10.7.4 or later. Until then: If immediate upgrading is not possible, reject candidate addresses longer than 64 characters before passing them to the Address6 constructor or isValid() method. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111997 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111997?** Check whether you run Beaugunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ip-address (npm): upgrade to 10.7.4 or later

  ```sh
  npm install ip-address@10.7.4
  ```


If immediate upgrading is not possible, reject candidate addresses longer than 64 characters before passing them to the Address6 constructor or isValid() method.

## Technical details

The Address6 constructor and related methods (isValid, fromAddressAndMask, fromAddressAndWildcardMask, fromAddress4Nat64, toAddress4Nat64) use a regex pattern /%.*$/ to strip zone identifiers without anchoring or preventing line terminator matching. When a string contains N percent characters followed by a newline, the regex engine attempts a match at each percent character position, causing O(N²) complexity. An attacker can supply input via URL-encoded request bodies or direct host parameters to trigger unbounded synchronous blocking.

## Affected products

- beaugunderson ip-address before 10.7.4

## Identifiers

- CVE-2026-111997
- GHSA-rxp7-6hxx-x8q5

## Timeline

- 2026-10-11: disclosed
- 2026-10-11: patched

## References

- [https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5)

## Related threats

- [ip-address Address6 regex denial of service](https://junglewise.ai/threats/duplicate-advisory-ip-address-address6-matches-a-zone-identifier-in-9feed89f)
- [ip-address Address6 isLinkLocal incomplete subnet check](https://junglewise.ai/threats/cve-2026-101913-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address logic error in subnet containment check](https://junglewise.ai/threats/cve-2026-101912-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address denial of service in Address6 constructor](https://junglewise.ai/threats/cve-2026-101911-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address library Address6 trust boundary bypass via NAT64 range](https://junglewise.ai/threats/cve-2026-101910-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)