{"id":"EUVD-2026-103378","revision":null,"records":[{"revision":"d8306bf3c9d8424d93105b6559e1f78a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-111997","aliases":[],"title":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","state":0,"publishedAt":"2026-10-18T00:07:21.112+00:00","modifiedAt":"2026-10-18T11:12:55.202+00:00","affected":[{"ecosystem":"Vendor product","name":"ip-address","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/ip-address\",\n                    \"product\": \"ip-address\",\n                    \"vendor\": \"beaugunderson\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"10.7.4\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111997","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111997","identifiers":["CVE-2026-111997"]},"retained":false,"historicalAffected":[]},{"revision":"889a1608535549099d5cab4f307b5b1b","observedAt":"2026-11-07T04:33:26.442+00:00","statement":{"source":"euvd","id":"EUVD-2026-103378","aliases":["CVE-2026-111997","GHSA-p3hm-x653-5rc6","GHSA-rxp7-6hxx-x8q5"],"title":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":null}],"references":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103378","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 18, 2026, 12:07:21 AM","dateUpdated":"Oct 18, 2026, 11:12:55 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-103378","identifiers":["EUVD-2026-103378","CVE-2026-111997","GHSA-p3hm-x653-5rc6","GHSA-rxp7-6hxx-x8q5"]},"retained":false,"historicalAffected":[]},{"revision":"fad99744fbb94bd6aa05baaecbadafee","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-111997","aliases":[],"title":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","state":0,"publishedAt":"2026-10-18T01:16:35.463+00:00","modifiedAt":"2026-10-19T21:13:39.973+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · cve@mitre.org · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-1333"],"productCriteria":[],"sourceDates":{"published":"2026-10-18T01:16:35.463","lastModified":"2026-10-19T21:13:39.973"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-111997","identifiers":["CVE-2026-111997"]},"retained":false,"historicalAffected":[]},{"revision":"8012b916faad4b75b9a206598871ec4c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-p3hm-x653-5rc6","aliases":[],"title":"Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-rxp7-6hxx-x8q5. This link is maintained to preserve external references.\n\n## Original Description\nip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","state":2,"publishedAt":"2026-10-18T03:32:37+00:00","modifiedAt":"2026-10-22T16:30:40.9950686+00:00","affected":[{"ecosystem":"npm","name":"ip-address","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"10.7.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997"],"sourceUrl":"https://github.com/advisories/GHSA-p3hm-x653-5rc6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-p3hm-x653-5rc6","identifiers":["GHSA-p3hm-x653-5rc6"]},"retained":false,"historicalAffected":[]},{"revision":"c478be9102c84b18bdcf9fbf182a14be","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-rxp7-6hxx-x8q5","aliases":["CVE-2026-111997"],"title":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","description":"### Summary\n\n`new Address6()` and `Address6.isValid()` strip a zone identifier with the pattern `/%.*$/` before they apply the 45-character length limit. When the string holds many `%` characters followed by a line terminator, the pattern is retried from every `%` and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 `%` characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same strings without the newline are rejected in under a millisecond.\n\nAn application that validates an attacker-supplied string with these methods can be stalled by a single long request. The input is rejected with the correct `AddressError`; the cost of reaching that rejection is the defect.\n\n### Details\n\nThe constructor in `src/ipv6.ts` removes the CIDR suffix, then the zone, then checks the length of what is left:\n\n```ts\nconst zone = constants6.RE_ZONE_STRING.exec(address);\n\nif (zone) {\n  this.zone = zone[0];\n\n  address = address.replace(constants6.RE_ZONE_STRING, '');\n}\n\nconst longest = this.groups * 5 + 5;\n\nif (address.length > longest) {\n  throw new AddressError(`IPv6 addresses are at most ${longest} characters.`);\n}\n```\n\n`RE_ZONE_STRING` is `/%.*$/`. It has no anchor at its start, `.` does not match a line terminator (`\\n`, `\\r`, U+2028 or U+2029), and without the `m` flag `$` matches only at the end of the input. For `%` repeated N times and then `\\n`, the engine starts a match at the first `%`, `.*` consumes the remaining `%` characters up to the newline, `$` fails there, and backtracking through every shorter `.*` fails too. The engine then starts again at the second `%`, and so on: N starts, each proportional to N. The length limit that follows rejects the string in constant time, after the scan has already run.\n\nThe line terminator need not be last. Any string in which many `%` characters precede a line terminator behaves the same way.\n\nEvery entry point that passes a caller's string to the `Address6` constructor is affected: `new Address6()`, `isValid()`, both arguments of `fromAddressAndMask()` and `fromAddressAndWildcardMask()`, and the prefix argument of `fromAddress4Nat64()` and `toAddress4Nat64()`. `fromWildcard()` rejects a `%` before it constructs anything, `fromURL()` admits only hex digits, colons and dots in a host, and `fromArpa()` checks the nibble grammar first, so those three are unaffected. `Address4` has no zone and is unaffected.\n\n### Affected versions\n\n`<= 10.7.3`. The zone pattern has been in the constructor since 1.0.0; 5.9.4, 9.0.5 and 10.7.0 show the same timings as 10.7.3.\n\n### Impact\n\n`Address6.isValid()` on N `%` characters and a newline, measured on ip-address 10.7.3 and node 24.21.0:\n\n| Input | Wall time | Same length of `!` |\n|---|---|---|\n| 5,461 characters | 13 ms | 0.1 ms |\n| 16 KiB | 108 ms | 0.1 ms |\n| 100 KB | 3.9 s | 0.1 ms |\n| 256 KiB | 27 s | 0.2 ms |\n\nThe parse is synchronous, so the event loop is blocked for the whole of the wall time and nothing else on that process is served. No memory is retained and the process resumes when the call returns.\n\n### Reachability\n\nThe input needs a line terminator after the `%` characters, which decides where it can arrive. An HTTP header value cannot carry a carriage return or a line feed, so a host or address taken from a header does not reach this. A URL can carry both characters percent-encoded at three bytes each, and Node's default 16 KB limit on the request line and headers admits about 5,461 of them: 13 ms. A request body is where the larger sizes come from. Common body parsers default to between 100 KB and 1 MB, and at 100 KB one field passed to the parser unchecked blocks the process for 3.9 s.\n\n### Proof of concept\n\n`npm i ip-address@10.7.3`, then:\n\n```js\nconst { Address6 } = require('ip-address');\n\nfunction time(input) {\n  const start = process.hrtime.bigint();\n\n  Address6.isValid(input);\n\n  return `${(Number(process.hrtime.bigint() - start) / 1e6).toFixed(1)} ms`;\n}\n\nfor (const n of [10000, 20000, 40000, 100000]) {\n  console.log(`${n}: ${time(`${'%'.repeat(n)}\\n`)}, without the newline ${time('%'.repeat(n))}`);\n}\n```\n\nOn affected versions (node 24.21.0):\n\n```\n10000: 41.0 ms, without the newline 0.0 ms\n20000: 161.1 ms, without the newline 0.0 ms\n40000: 632.4 ms, without the newline 0.1 ms\n100000: 3899.8 ms, without the newline 0.1 ms\n```\n\nEach doubling of the input multiplies the time by four.\n\n### Remediation\n\nUpgrade to the patched release. In the fix, the constructor finds the zone by the index of the first `%` and accepts the remainder as a zone only when it holds no line terminator, which reads the input once. 1 MiB of the input above is rejected in about a millisecond. Every address that parsed before parses to the same result, and a string with a line terminator after a `%` is rejected as it was.\n\n`RE_ZONE_STRING` stays exported from `v6/constants` for code that imports it directly and is marked `@deprecated`; the library itself does not call it.\n\nIf you cannot upgrade immediately, reject a candidate longer than an address with a zone identifier can be before you parse it:\n\n```js\nif (host.length > 64) throw new Error('not an IP address');\n```","state":0,"publishedAt":"2026-10-22T16:19:39+00:00","modifiedAt":"2026-10-22T16:30:30.1293568+00:00","affected":[{"ecosystem":"npm","name":"ip-address","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"10.7.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"sourceUrl":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rxp7-6hxx-x8q5","identifiers":["GHSA-rxp7-6hxx-x8q5","CVE-2026-111997"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T08:01:16.4582549+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T08:01:16.4582549+00:00","lastSuccessAt":"2026-11-08T08:01:16.6552308+00:00","error":null,"lastVerifiedAt":"2026-11-08T08:01:16.655233+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-e58a079eb6f76d5949b871c295ad9e8f78e928765ff9950581a38d46375b9852","complete":true,"records":421096,"lastAttemptAt":"2026-11-08T07:59:14.338564+00:00","lastSuccessAt":"2026-11-08T07:59:14.3145447+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:59:14.338564+00:00","snapshotPublishedAt":"2026-11-08T07:27:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T08:01:42.629051+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T08:01:16.4582549+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T08:01:16.4582549+00:00","lastSuccessAt":"2026-11-08T08:01:16.8174871+00:00","error":null,"lastVerifiedAt":"2026-11-08T08:01:16.8174888+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1ec7239e56a54da3b2b0610ad89103be","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T08:01:42.0530448+00:00","lastSuccessAt":"2026-11-08T08:01:42.049+00:00","error":null,"lastVerifiedAt":"2026-11-08T08:01:42.049+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T08:01:16.3917011+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T08:01:16.3917011+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T07:59:14.4078984+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:59:14.4078984+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T08:01:16.4078439+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T08:01:16.4078439+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-8efbf882841c7fda0cba0c3b55677f4781f461b96ab83577ad2701c4eaf88b1e","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T08:01:16.2657557+00:00","lastSuccessAt":"2026-11-08T08:01:14.837451+00:00","error":null,"lastVerifiedAt":"2026-11-08T08:01:16.2657557+00:00","snapshotPublishedAt":"2026-11-08T07:33:16+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}