CVE-2026-101911Medium· 6.3▾ TwilightPoC availableip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Exploit / PoC code exists
0.3% → 0.4%
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
ip-address <= 10.7.0Patched in:
ip-address 10.7.1Source: https://github.com/advisories/GHSA-h3mg-xc3c-68pw
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101912Medium· 6.3ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-111997Medium· 5.3ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
CVE-2026-101913Medium· 6.3ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-101910Medium· 6.9ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-42338Medium· 6.1ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2020-8659High· 7.5CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e