CVE-2026-101911: 
JavaScript vulnerability analysis and mitigation

CVE-2026-101911 is a Denial of Service vulnerability in the ip-address JavaScript library (npm package by beaugunderson) caused by unbounded string parsing in the Address6 constructor and Address6.isValid() method. All versions up to and including 10.7.0 are affected; the issue is fixed in version 10.7.1. The vulnerability was published on September 28, 2026, with the GitHub Security Advisory (GHSA-h3mg-xc3c-68pw) published September 29, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat).

The root cause is uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770) in src/ipv6.ts. When parse() encounters characters outside the valid IPv6 character set [0-9a-f:/%] (matched by RE_BAD_CHARACTERS), it builds an error diagnostic by wrapping each offending character in a 34-byte HTML <span class="parse-error"> tag via String.replace(), causing the output string to grow to approximately 34× the input size. No length check is performed before this operation, so Address6.isValid() — which calls the constructor and discards the result — pays the full parsing cost even when only checking validity. The attack requires no authentication and is reachable over the network wherever an application accepts user-supplied strings and passes them to Address6 parsing functions without a prior length bound (GitHub Advisory, Red Hat Bugzilla).

Exploitation causes availability impact only — there is no confidentiality or integrity impact. A 1 MiB payload of invalid characters causes approximately 73 ms of synchronous event-loop stall and 112 MB of transient heap allocation; 8 MiB causes ~464 ms stall and ~784 MB heap usage; 16 MiB throws an uncaught RangeError: Invalid string length (which bypasses instanceof AddressError guards); and 32 MiB triggers a fatal V8 abort (Fatal JavaScript invalid size error) that terminates the Node.js process entirely and cannot be caught by any try/catch. Because the parse is synchronous, the event loop is fully blocked for the duration, denying service to all other requests on the same process (GitHub Advisory).

A JavaScript proof-of-concept is publicly available in the GitHub Security Advisory, demonstrating the DoS by calling Address6.isValid() and new Address6() with crafted megabyte-scale inputs. The EPSS score is approximately 0.003 (0.3%), indicating low probability of widespread exploitation. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is constrained in practice by common HTTP body-parser defaults (typically 100 KB–1 MB), which limit the stall to under 100 ms per request; the process-terminating 32 MiB payload requires an application that explicitly accepts very large request bodies (GitHub Advisory, Red Hat).

1. Identify target: Locate a Node.js application that uses ip-address <= 10.7.0 and exposes an endpoint that accepts user-supplied strings passed to Address6.isValid() or new Address6() without a prior length check — for example, an IP address validation endpoint in an API.
2. Assess body size limits: Determine the application's request body size limit. If the default (e.g., 100 KB–1 MB) is in place, the attacker can still cause a stall of up to ~100 ms per request. For process termination, the application must accept ≥32 MiB fields.
3. Craft the payload: Construct a string of 1–32 MiB composed entirely of characters invalid in IPv6 addresses (e.g., '!'.repeat(mib * 1024 * 1024)). These characters are all matched by RE_BAD_CHARACTERS and trigger the diagnostic expansion path.
4. Transmit the payload: Send the crafted string to the target endpoint via an HTTP POST request body or any other input vector the application forwards to the IPv6 parser without length validation.
5. Trigger resource exhaustion: The application calls Address6.isValid(input) or new Address6(input), which invokes parse() in src/ipv6.ts. The String.replace() call expands each invalid character into a 34-byte span, allocating up to 34× the input size in memory and blocking the event loop synchronously.
6. Achieve DoS: Depending on payload size — (a) ≥1 MiB: event-loop stall and memory spike; (b) ≥16 MiB: uncaught RangeError that may bypass error handlers; (c) ≥32 MiB: fatal V8 abort terminating the Node.js process (GitHub Advisory).

• Network: Unusually large HTTP POST requests (megabyte-scale bodies) to endpoints that perform IP address validation; repeated requests with oversized payloads from a single source IP.
• Logs: Node.js application logs showing RangeError: Invalid string length exceptions originating from ip-address library code paths; fatal error messages such as Fatal JavaScript invalid size error 142606336 in process output or crash logs.
• Process: Node.js process termination or restart events correlated with large inbound requests; significant transient heap spikes (hundreds of MB) visible in APM or memory monitoring tools during request processing.
• Application: Increased response latency or timeouts on IP validation endpoints; event loop lag metrics spiking to hundreds of milliseconds per request (GitHub Advisory).

Upgrade the ip-address npm package to version 10.7.1, which rejects any address string longer than 45 characters (IPv6) or 15 characters (IPv4) before parse() runs, making the fix a constant-time length comparison (GitHub Release, Patch Commit). If an immediate upgrade is not possible, add an explicit length guard before any call to Address6 parsing functions: if (host.length > 64) throw new Error('not an IP address');. Additionally, ensure HTTP body-parser limits are set to conservative defaults (100 KB or less for fields containing IP addresses) to constrain the maximum stall to well under 100 ms per request (GitHub Advisory).