{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-101911", "tracking": { "current_release_date": "2026-10-03T00:26:23.297600Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-101911", "initial_release_date": "2026-09-28T18:29:03.994288Z", "revision_history": [ { "date": "2026-09-28T18:29:03.994288Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-09-28T18:29:06.286177Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-28T18:38:38.655018Z", "number": "3", "summary": "CVSS created.| CWES created (2).| Products created (1).| References created (4).| Description created for source.| Unknown change." }, { "date": "2026-09-28T18:38:50.219603Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-09-29T00:45:05.272454Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Products connected (1)." }, { "date": "2026-09-29T00:45:13.721389Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-09-29T06:38:10.575961Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (3).| Products connected (55).| References created (6).| CWES updated (1)." }, { "date": "2026-09-29T06:43:54.895409Z", "number": "8", "summary": "Description created for source." }, { "date": "2026-09-29T12:29:41.464380Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (4).| Product Identifiers created (1).| References created (6).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-29T12:29:45.405195Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-09-29T16:12:56.007351Z", "number": "11", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-29T18:31:45.833783Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-09-30T00:39:58.302440Z", "number": "13", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (6).| CWES updated (1)." }, { "date": "2026-09-30T00:40:01.916631Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-10-03T00:00:48.853963Z", "number": "15", "summary": "Unknown change." } ], "status": "interim", "version": "15" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-6014972", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_name", "name": "Red Hat Hardened Images" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902830" } } ], "category": "product_name", "name": "grafana12.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902831" } } ], "category": "product_name", "name": "grafana13.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053231" } } ], "category": "product_name", "name": "grafana13.2" } ], "category": "product_family", "name": "Red Hat Hardened Images" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/1.0.0", "product": { "name": "vers:unknown/1.0.0", "product_id": "CSAFPID-8057696" } }, { "category": "product_version_range", "name": "vers:unknown/1.1.0", "product": { "name": "vers:unknown/1.1.0", "product_id": "CSAFPID-8057697" } }, { "category": "product_version_range", "name": "vers:unknown/2.0.0", "product": { "name": "vers:unknown/2.0.0", "product_id": "CSAFPID-8057698" } }, { "category": "product_version_range", "name": "vers:unknown/<10.7.1", "product": { "name": "vers:unknown/<10.7.1", "product_id": "CSAFPID-9482861" } }, { "category": "product_version_range", "name": "vers:unknown/v10.0.0", "product": { "name": "vers:unknown/v10.0.0", "product_id": "CSAFPID-8603576" } }, { "category": "product_version_range", "name": "vers:unknown/v10.0.1", "product": { "name": "vers:unknown/v10.0.1", "product_id": "CSAFPID-8603575" } }, { "category": "product_version_range", "name": "vers:unknown/v10.1.0", "product": { "name": "vers:unknown/v10.1.0", "product_id": "CSAFPID-8603574" } }, { "category": "product_version_range", "name": "vers:unknown/v10.1.1", "product": { "name": "vers:unknown/v10.1.1", "product_id": "CSAFPID-8901868" } }, { "category": "product_version_range", "name": "vers:unknown/v10.2.0", "product": { "name": "vers:unknown/v10.2.0", "product_id": "CSAFPID-8923137" } }, { "category": "product_version_range", "name": "vers:unknown/v10.2.1", "product": { "name": "vers:unknown/v10.2.1", "product_id": "CSAFPID-8932681" } }, { "category": "product_version_range", "name": "vers:unknown/v10.2.2", "product": { "name": "vers:unknown/v10.2.2", "product_id": "CSAFPID-8932680" } }, { "category": "product_version_range", "name": "vers:unknown/v10.3.0", "product": { "name": "vers:unknown/v10.3.0", "product_id": "CSAFPID-8932679" } }, { "category": "product_version_range", "name": "vers:unknown/v10.3.1", "product": { "name": "vers:unknown/v10.3.1", "product_id": "CSAFPID-9485009" } }, { "category": "product_version_range", "name": "vers:unknown/v10.4.0", "product": { "name": "vers:unknown/v10.4.0", "product_id": "CSAFPID-9485008" } }, { "category": "product_version_range", "name": "vers:unknown/v10.5.0", "product": { "name": "vers:unknown/v10.5.0", "product_id": "CSAFPID-9485007" } }, { "category": "product_version_range", "name": "vers:unknown/v10.5.1", "product": { "name": "vers:unknown/v10.5.1", "product_id": "CSAFPID-9485061" } }, { "category": "product_version_range", "name": "vers:unknown/v10.6.0", "product": { "name": "vers:unknown/v10.6.0", "product_id": "CSAFPID-9485060" } }, { "category": "product_version_range", "name": "vers:unknown/v10.7.0", "product": { "name": "vers:unknown/v10.7.0", "product_id": "CSAFPID-9485059" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.1", "product": { "name": "vers:unknown/v2.0.1", "product_id": "CSAFPID-8603617" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.2", "product": { "name": "vers:unknown/v2.0.2", "product_id": "CSAFPID-8603616" } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.0", "product": { "name": "vers:unknown/v3.1.0", "product_id": "CSAFPID-8603615" } }, { "category": "product_version_range", "name": "vers:unknown/v5.2.0", "product": { "name": "vers:unknown/v5.2.0", "product_id": "CSAFPID-8603614" } }, { "category": "product_version_range", "name": "vers:unknown/v5.3.0", "product": { "name": "vers:unknown/v5.3.0", "product_id": "CSAFPID-8603613" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.0", "product": { "name": "vers:unknown/v5.4.0", "product_id": "CSAFPID-8603612" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.1", "product": { "name": "vers:unknown/v5.4.1", "product_id": "CSAFPID-8603611" } }, { "category": "product_version_range", "name": "vers:unknown/v5.5.0", "product": { "name": "vers:unknown/v5.5.0", "product_id": "CSAFPID-8603610" } }, { "category": "product_version_range", "name": "vers:unknown/v5.6.0", "product": { "name": "vers:unknown/v5.6.0", "product_id": "CSAFPID-8603609" } }, { "category": "product_version_range", "name": "vers:unknown/v5.7.0", "product": { "name": "vers:unknown/v5.7.0", "product_id": "CSAFPID-8603608" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.0", "product": { "name": "vers:unknown/v5.8.0", "product_id": "CSAFPID-8603607" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.1", "product": { "name": "vers:unknown/v5.8.1", "product_id": "CSAFPID-8603606" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.2", "product": { "name": "vers:unknown/v5.8.2", "product_id": "CSAFPID-8603605" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.3", "product": { "name": "vers:unknown/v5.8.3", "product_id": "CSAFPID-8603604" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.4", "product": { "name": "vers:unknown/v5.8.4", "product_id": "CSAFPID-8603603" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.5", "product": { "name": "vers:unknown/v5.8.5", "product_id": "CSAFPID-8603602" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.6", "product": { "name": "vers:unknown/v5.8.6", "product_id": "CSAFPID-8603601" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.7", "product": { "name": "vers:unknown/v5.8.7", "product_id": "CSAFPID-8603600" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.8", "product": { "name": "vers:unknown/v5.8.8", "product_id": "CSAFPID-8603599" } }, { "category": "product_version_range", "name": "vers:unknown/v5.8.9", "product": { "name": "vers:unknown/v5.8.9", "product_id": "CSAFPID-8603598" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.0", "product": { "name": "vers:unknown/v5.9.0", "product_id": "CSAFPID-8603597" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.1", "product": { "name": "vers:unknown/v5.9.1", "product_id": "CSAFPID-8603596" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.2", "product": { "name": "vers:unknown/v5.9.2", "product_id": "CSAFPID-8603595" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.3", "product": { "name": "vers:unknown/v5.9.3", "product_id": "CSAFPID-8603594" } }, { "category": "product_version_range", "name": "vers:unknown/v5.9.4", "product": { "name": "vers:unknown/v5.9.4", "product_id": "CSAFPID-8603593" } }, { "category": "product_version_range", "name": "vers:unknown/v6.0.0", "product": { "name": "vers:unknown/v6.0.0", "product_id": "CSAFPID-8603592" } }, { "category": "product_version_range", "name": "vers:unknown/v6.1.0", "product": { "name": "vers:unknown/v6.1.0", "product_id": "CSAFPID-8603591" } }, { "category": "product_version_range", "name": "vers:unknown/v6.2.0", "product": { "name": "vers:unknown/v6.2.0", "product_id": "CSAFPID-8603590" } }, { "category": "product_version_range", "name": "vers:unknown/v6.3.0", "product": { "name": "vers:unknown/v6.3.0", "product_id": "CSAFPID-8603589" } }, { "category": "product_version_range", "name": "vers:unknown/v6.4.0", "product": { "name": "vers:unknown/v6.4.0", "product_id": "CSAFPID-8603588" } }, { "category": "product_version_range", "name": "vers:unknown/v7.0.0", "product": { "name": "vers:unknown/v7.0.0", "product_id": "CSAFPID-8603587" } }, { "category": "product_version_range", "name": "vers:unknown/v7.0.1", "product": { "name": "vers:unknown/v7.0.1", "product_id": "CSAFPID-8603586" } }, { "category": "product_version_range", "name": "vers:unknown/v7.1.0", "product": { "name": "vers:unknown/v7.1.0", "product_id": "CSAFPID-8603585" } }, { "category": "product_version_range", "name": "vers:unknown/v8.0.0", "product": { "name": "vers:unknown/v8.0.0", "product_id": "CSAFPID-8603584" } }, { "category": "product_version_range", "name": "vers:unknown/v8.1.0", "product": { "name": "vers:unknown/v8.1.0", "product_id": "CSAFPID-8603583" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.0", "product": { "name": "vers:unknown/v9.0.0", "product_id": "CSAFPID-8603582" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.1", "product": { "name": "vers:unknown/v9.0.1", "product_id": "CSAFPID-8603581" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.2", "product": { "name": "vers:unknown/v9.0.2", "product_id": "CSAFPID-8603580" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.3", "product": { "name": "vers:unknown/v9.0.3", "product_id": "CSAFPID-8603579" } }, { "category": "product_version_range", "name": "vers:unknown/v9.0.5", "product": { "name": "vers:unknown/v9.0.5", "product_id": "CSAFPID-8603578" } }, { "category": "product_version_range", "name": "vers:unknown/v9.1.0-0", "product": { "name": "vers:unknown/v9.1.0-0", "product_id": "CSAFPID-8603577" } } ], "category": "product_name", "name": "ip-address" } ], "category": "vendor", "name": "beaugunderson" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-7088727" } } ], "category": "product_name", "name": "node-ip-address" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-101911", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-101911" }, { "category": "description", "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-101911" }, { "category": "description", "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101911.json?alt=media" }, { "category": "description", "text": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-101911" }, { "category": "description", "text": "A flaw was found in the ip-address library. A remote attacker can exploit this vulnerability by supplying an excessively large IPv6 address string to an application that parses input without length limits. The parser attempts to process the unbounded input and generate disproportionately large error diagnostics, leading to excessive memory consumption. This issue can lead to a Denial of Service (DoS) by causing the application process to stall or crash.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-101911" }, { "category": "description", "text": "### Summary\n\n`new Address6()` and `Address6.isValid()` place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte ``, so the work and the memory scale with the input rather than with an address. A 1 MiB string of `!` costs about 110 MB and 70 ms of synchronous work, 8 MiB costs about 800 MB and half a second, 16 MiB throws a `RangeError` in place of the documented `AddressError`, and 32 MiB aborts the Node process. `isValid()` builds the diagnostic and discards it, so a caller that only asks whether a string is valid pays the full price.\n\nAn application that validates an attacker-supplied string with these methods can be stalled or crashed by a single oversized request. This is a crash on input that should have been rejected cleanly, which SECURITY.md lists as in scope.\n\n### Details\n\n`parse()` in `src/ipv6.ts` checks for characters outside `[0-9a-f:/%]` and, on finding any, throws an `AddressError` whose `parseMessage` is the whole input with each offending character wrapped:\n\n```ts\nconst badCharacters = address.match(constants6.RE_BAD_CHARACTERS);\n\nif (badCharacters) {\n throw new AddressError(\n `Bad character${badCharacters.length > 1 ? 's' : ''} detected in address: ${badCharacters.join('')}`,\n address.replace(constants6.RE_BAD_CHARACTERS, '$1'),\n );\n}\n```\n\n`RE_BAD_CHARACTERS` is `/([^0-9a-f:/%])/gi`. For an input made entirely of punctuation the `match` allocates one string per character, the `join` copies them all into the message, and the `replace` produces a string 34 times the input. Nothing before this point looks at the length: the constructor strips a CIDR suffix and a zone identifier and hands the rest to `parse()`. The `RE_BAD_ADDRESS` branch below it builds its diagnostic the same way at about a third of the ratio, for input in the hex-and-colon alphabet such as `fffff:` repeated.\n\n`parse()` is reached only through the constructor, so every entry point that constructs an `Address6` from a string it has not already bounded is affected: `new Address6()`, `isValid()`, both arguments of `fromAddressAndMask()` and `fromAddressAndWildcardMask()`, `fromWildcard()`, and the prefix argument of `fromAddress4Nat64()` and `toAddress4Nat64()`. `fromURL()` admits only hex, colons, and dots in a host, so it reaches the `RE_BAD_ADDRESS` branch and not the other. `fromArpa()` caps its input at 32 nibbles before constructing anything, and `fromBigInt()`, `fromByteArray()`, and `fromAddress4()` build the string themselves, so those are unaffected.\n\nThe `replace` is where size becomes fatal. V8 caps a string at 2^29 - 24 characters, so past 16 MiB of input the `replace` throws `RangeError: Invalid string length` rather than the `AddressError` callers catch; `isValid()` swallows it, but a constructor call guarded by `instanceof AddressError` does not. Past 32 MiB the replacement builder's internal array exceeds its maximum size and V8 aborts the process with `Fatal JavaScript invalid size error`, which no `try`/`catch` intercepts.\n\n### Affected versions\n\n`<= 10.7.0`. The diagnostic has had this shape since the parser was written, so every release is affected.\n\n### Impact\n\n`Address6.isValid()` on N bytes of `!`, measured on node 24.19.0:\n\n| Input | Wall time | Transient heap | Outcome |\n|---|---|---|---|\n| 16 KiB | 1 ms | 1 MB | `false` |\n| 1 MiB | 73 ms | 112 MB | `false` |\n| 8 MiB | 464 ms | 784 MB | `false` |\n| 16 MiB | | | `RangeError: Invalid string length` from the constructor; `isValid()` returns `false` |\n| 32 MiB | | | the process aborts |\n\nThe parse is synchronous, so the event loop is blocked for the whole of the wall time and nothing else on that process is served. The heap is transient and is reclaimed after the call returns, so memory does not accumulate across requests; the abort at 32 MiB is a single request. `Address4` has no diagnostic of this shape and parses the same 8 MiB in a few milliseconds.\n\n### Reachability\n\nReaching the sizes above requires that the application hand the parser a string it has not already bounded. A host taken from a URL or an HTTP header is bounded by the server's header limit (Node's default is 16 KB), and at that size the cost is a millisecond. The megabyte sizes need a request body the application accepts at that scale and passes through unchecked. Common body parsers default to between 100 KB and 1 MB, which caps the effect at a stall of under 100 ms per request, and the abort needs 32 MiB in a single field, which no default admits. The severity is scored for the stall, not the abort: an application that accepts 32 MiB bodies into an address parser is the exception, and the reader running one should treat this as a crash.\n\n### Proof of concept\n\n`npm i ip-address@10.7.0`, then:\n\n```js\nconst { Address6 } = require('ip-address');\n\nfor (const mib of [1, 8]) {\n const input = '!'.repeat(mib * 1024 * 1024);\n const before = process.memoryUsage().heapUsed;\n const start = process.hrtime.bigint();\n\n Address6.isValid(input);\n\n const ms = Number(process.hrtime.bigint() - start) / 1e6;\n const mb = (process.memoryUsage().heapUsed - before) / 1048576;\n\n console.log(`${mib} MiB: ${ms.toFixed(0)} ms, ${mb.toFixed(0)} MB`);\n}\n\ntry {\n new Address6('!'.repeat(16 * 1024 * 1024));\n} catch (e) {\n console.log(`16 MiB: ${e.name}: ${e.message}`);\n}\n\nnew Address6('!'.repeat(32 * 1024 * 1024));\n```\n\nOn affected versions (node 24.19.0):\n\n```\n1 MiB: 73 ms, 112 MB\n8 MiB: 464 ms, 784 MB\n16 MiB: RangeError: Invalid string length\n\n\n#\n# Fatal error in , line 0\n# Fatal JavaScript invalid size error 142606336\n#\n```\n\nThe last line is V8 terminating the process; the script does not reach its end.\n\n### Remediation\n\nUpgrade to the patched release. In the fix, the constructor rejects an address longer than the family allows before `parse()` runs: 45 characters for IPv6 once the CIDR suffix and zone identifier are stripped (six four-digit groups, six colons, and a dotted quad, the same line CPython's `ipaddress` module draws), and 15 characters for IPv4. The rejection is an `AddressError` with no `parseMessage`, so `isValid()` returns `false` for the cost of a length comparison and the 32 MiB input above is rejected in the same time as a 46-character one. A zone identifier is not counted, since it never reaches the diagnostic.\n\nThis rejects nothing a previous release accepted: every string longer than the limit already failed to parse.\n\nIf you cannot upgrade immediately, reject a candidate longer than an address with a zone identifier can be before you parse it:\n\n```js\nif (host.length > 64) throw new Error('not an IP address');\n```", "title": "github - https://github.com/advisories/GHSA-h3mg-xc3c-68pw" }, { "category": "other", "text": "0.00301", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "6.3", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.1", "title": "NCSC Score" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 2\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-9482861", "CSAFPID-7088727", "CSAFPID-8057696", "CSAFPID-8057697", "CSAFPID-8057698", "CSAFPID-8603574", "CSAFPID-8603575", "CSAFPID-8603576", "CSAFPID-8603577", "CSAFPID-8603578", "CSAFPID-8603579", "CSAFPID-8603580", "CSAFPID-8603581", "CSAFPID-8603582", "CSAFPID-8603583", "CSAFPID-8603584", "CSAFPID-8603585", "CSAFPID-8603586", "CSAFPID-8603587", "CSAFPID-8603588", "CSAFPID-8603589", "CSAFPID-8603590", "CSAFPID-8603591", "CSAFPID-8603592", "CSAFPID-8603593", "CSAFPID-8603594", "CSAFPID-8603595", "CSAFPID-8603596", "CSAFPID-8603597", "CSAFPID-8603598", "CSAFPID-8603599", "CSAFPID-8603600", "CSAFPID-8603601", "CSAFPID-8603602", "CSAFPID-8603603", "CSAFPID-8603604", "CSAFPID-8603605", "CSAFPID-8603606", "CSAFPID-8603607", "CSAFPID-8603608", "CSAFPID-8603609", "CSAFPID-8603610", "CSAFPID-8603611", "CSAFPID-8603612", "CSAFPID-8603613", "CSAFPID-8603614", "CSAFPID-8603615", "CSAFPID-8603616", "CSAFPID-8603617", "CSAFPID-8901868", "CSAFPID-8923137", "CSAFPID-8932679", "CSAFPID-8932680", "CSAFPID-8932681", "CSAFPID-9485007", "CSAFPID-9485008", "CSAFPID-9485009", "CSAFPID-9485059", "CSAFPID-9485060", "CSAFPID-9485061", "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-9053231" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101911" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-101911" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101911" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-101911" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101911.json?alt=media" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-101911" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101911.json" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101911" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101911" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-6014972", "CSAFPID-7088727", "CSAFPID-8057696", "CSAFPID-8057697", "CSAFPID-8057698", "CSAFPID-8603574", "CSAFPID-8603575", "CSAFPID-8603576", "CSAFPID-8603577", "CSAFPID-8603578", "CSAFPID-8603579", "CSAFPID-8603580", "CSAFPID-8603581", "CSAFPID-8603582", "CSAFPID-8603583", "CSAFPID-8603584", "CSAFPID-8603585", "CSAFPID-8603586", "CSAFPID-8603587", "CSAFPID-8603588", "CSAFPID-8603589", "CSAFPID-8603590", "CSAFPID-8603591", "CSAFPID-8603592", "CSAFPID-8603593", "CSAFPID-8603594", "CSAFPID-8603595", "CSAFPID-8603596", "CSAFPID-8603597", "CSAFPID-8603598", "CSAFPID-8603599", "CSAFPID-8603600", "CSAFPID-8603601", "CSAFPID-8603602", "CSAFPID-8603603", "CSAFPID-8603604", "CSAFPID-8603605", "CSAFPID-8603606", "CSAFPID-8603607", "CSAFPID-8603608", "CSAFPID-8603609", "CSAFPID-8603610", "CSAFPID-8603611", "CSAFPID-8603612", "CSAFPID-8603613", "CSAFPID-8603614", "CSAFPID-8603615", "CSAFPID-8603616", "CSAFPID-8603617", "CSAFPID-8901868", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-8923137", "CSAFPID-8932679", "CSAFPID-8932680", "CSAFPID-8932681", "CSAFPID-9053231", "CSAFPID-9482861", "CSAFPID-9485007", "CSAFPID-9485008", "CSAFPID-9485009", "CSAFPID-9485059", "CSAFPID-9485060", "CSAFPID-9485061" ] } ], "title": "CVE-2026-101911" } ] }