Vulnerability in ip-address (CVE-2026-101911)
Summary
Vulnerability in ip-address (CVE-2026-101911). Risk of unauthorized operations or information disclosure. Exploitable via RangeError. Mitigation: upgrade to 10.7.1 or later.
Original description
The description as published by the source.
Summary
new Address6() and Address6.isValid() place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte ``, so the work and the memory scale with the input rather than with an address. A 1 MiB string of ! costs about 110 MB and 70 ms of synchronous work, 8 MiB costs about 800 MB and half a second, 16 MiB throws a RangeError in place of the documented AddressError, and 32 MiB aborts the Node process. isValid() builds the diagnostic and discards it, so a caller that only asks whether a string is valid pays the full price.
An application that validates an attacker-supplied string with these methods can be stalled or crashed by a single oversized request. This is a crash on input that should have been rejected cleanly, which SECURITY.md lists as in scope.
Details
parse() in src/ipv6.ts checks for characters outside [0-9a-f:/%] and, on finding any, throws an AddressError whose parseMessage is the whole input with each offending character wrapped:
const badCharacters = address.match(constants6.RE_BAD_CHARACTERS);
if (badCharacters) {
throw new AddressError(
`Bad character${badCharacters.length > 1 ? 's' : ''} detected in address: ${badCharacters.join('')}`,
address.replace(constants6.RE_BAD_CHARACTERS, '$1'),
);
}
RE_BAD_CHARACTERS is /([^0-9a-f:/%])/gi. For an input made e…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-101911 has been found in ip-address.
Attackers can target a specific entry point like RangeError over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade ip-address to 10.7.1 or later.
If unsure, ask your IT team or search "ip-address CVE-2026-101911" on the vendor's site.
CVE-2026-101911 (ip-address) — CWE-400
Attack surface: RangeError / AddressError / parseMessage / RE_BAD_CHARACTERS
Patched: 10.7.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-400) exists in ip-address. Attackers reach the vulnerable code path via RangeError.
Check the vendor advisory for the affected versions of ip-address. Attack surface: RangeError / AddressError / parseMessage / RE_BAD_CHARACTERS.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 10.7.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'ip-address' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'ip-address' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
ip-addressを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade ip-address to 10.7.1ステージング環境で 10.7.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- web github.com
- web github.com
- web github.com
- web github.com
- web nvd.nist.gov
- web github.com