# ip-address Address6 regex denial of service

Source: https://junglewise.ai/threats/duplicate-advisory-ip-address-address6-matches-a-zone-identifier-in-9feed89f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-10-18

The npm ip-address library is used to validate and parse IPv6 addresses. A vulnerability in how it matches zone identifiers using an inefficient regular expression allows an attacker to submit a specially crafted input string that causes the application to consume excessive CPU and become unresponsive. This can affect any service that validates user-supplied IP addresses without length checks.

Technologies: [Beaugunderson Ip-Address](https://junglewise.ai/threats/technologies/beaugunderson-ip-address), [ip-address (npm)](https://junglewise.ai/threats/technologies/ip-address). Vendors: [Beaugunderson](https://junglewise.ai/threats/vendors/beaugunderson), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 18 October 2026.

**Which products and versions are affected?** Beau Gunderson Ip-Address <= 10.7.3; Beaugunderson Ip-Address <= 10.7.3; ip-address (npm) <= 10.7.3, SEMVER:introduced=0,last_affected=10.7.3.

**Is there a fix for This vulnerability?** Yes: fixed in 10.7.4. Until then: Reject candidate IP addresses longer than 64 characters before passing them to the parser. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Beau Gunderson Ip-Address, Beaugunderson Ip-Address or ip-address (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.7.4

Reject candidate IP addresses longer than 64 characters before passing them to the parser.

## Technical details

The Address6 constructor uses a regex pattern (/%.*$/) to strip zone identifiers that exhibits quadratic time complexity when processing input containing many % characters followed by a line terminator. Each % character triggers a new regex match attempt, with backtracking proportional to the remaining string length, resulting in O(N²) behavior. An attacker can stall the synchronous parsing with a single request containing 100,000 characters in under 4 seconds of blocking CPU time.

## Affected products

- beaugunderson ip-address <= 10.7.3

## Timeline

- 2026-10-11: disclosed
- 2026-10-11: patched: fixed in version 10.7.4
- 2026-10-18: advisory

## References

- [https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5)

## Related threats

- [ip-address Address6 quadratic regex denial of service](https://junglewise.ai/threats/cve-2026-111997-ip-address-before-10-7-4-allows-a-denial-of-service-cpu)
- [ip-address Address6 isLinkLocal incomplete subnet check](https://junglewise.ai/threats/cve-2026-101913-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address logic error in subnet containment check](https://junglewise.ai/threats/cve-2026-101912-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address denial of service in Address6 constructor](https://junglewise.ai/threats/cve-2026-101911-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)
- [ip-address library Address6 trust boundary bypass via NAT64 range](https://junglewise.ai/threats/cve-2026-101910-ip-address-is-a-library-for-parsing-and-manipulating-ipv4-and)