CVE-2026-101911: ip-address Package Allows Denial of Service via Unbounded Input Parsing
Summary
CVE-2026-101911: new Address6() and Address6.isValid() place no bound on the length of the string they parse. Affects ip-address versions < 10.7.1. Fixed in 10.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ip-address package is a widely used library in the Node.js ecosystem that provides utilities for working with IP addresses, including validation and parsing of both IPv4 and IPv6 addresses. It is designed to facilitate the manipulation and validation of IP addresses in web applications. However, a critical vulnerability has been identified that allows for denial of service through unbounded input parsing, which can lead to excessive memory consumption and process crashes.
Vulnerability Detail
The vulnerability arises from the methods new Address6() and Address6.isValid(), which do not impose a length restriction on the input strings they parse. When an invalid character is detected in an IPv6 address, the parser generates a diagnostic message that scales with the input size, leading to significant memory usage and processing time. For instance, a 1 MiB input string can consume around 110 MB of memory and take 70 ms to process, while larger inputs can cause the Node process to crash. This vulnerability can be exploited by an attacker who sends oversized requests, potentially stalling or crashing the application.
How To Fix
Latest published version: 10.7.4 as of 23 Oct 2026
npm install ip-address@10.7.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.7.1
This is the first release that contains the fix.
npm install ip-address@10.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, implement a workaround by rejecting any input longer than the maximum allowed length for an IP address. For example, you can add the following code before parsing the input:
if (host.length > 64) throw new Error('not an IP address');
Conclusion
The ip-address package has a critical vulnerability (CVE-2026-101911) that can lead to denial of service through unbounded input parsing. It is essential to upgrade to the patched version or implement a workaround to safeguard your application from potential crashes and excessive resource consumption.
See every vulnerability recorded for ip-address →
FAQ
CVE-2026-101911 is a vulnerability in the ip-address package that allows for denial of service through unbounded input parsing, potentially leading to application crashes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
The vulnerability can lead to significant memory consumption and processing delays, potentially causing the application to stall or crash when handling oversized input.
The recommended action is to upgrade the ip-address package to version 10.7.1 or later, which includes a fix for this vulnerability.
Yes, you can implement a workaround by checking the length of the input string before parsing it and rejecting any that exceed the maximum allowed length.
References
Related vulnerabilities
Recent vulnerabilities recorded for ip-address.
