ip-address EUVD-2026-103378

Exploitation requires that the consuming application pass attacker-controlled input containing many '%' characters into a function that invokes the ip-address library's Address6 constructor (the IPv6 parsing path); this is reflected by the CVSS AT:P attack requirement. The flaw is not triggered against the library in isolation - a code path that forwards untrusted input to Address6 parsing must exist and be reachable. Limiting factors: impact is availability-only and partial (CPU consumption/application stall, VA:L, not a hard crash of unrelated systems), and the vulnerable path must handle untrusted data for network-reachable exploitation to apply. Upgrading to ip-address 10.7.4 or later removes the condition.

This is a medium-severity denial-of-service issue (CVSS 4.0 base 6.3, CWE-1333 inefficient regular expression / quadratic complexity) in the 'ip-address' npm library before 10.7.4. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated vector, but the AT:P flag signals an attack requirement - the vulnerable Address6 code path must actually receive attacker-controlled input, so it is not universally reachable. Impact is limited to availability only (VC:N/VI:N/VA:L), confirming no confidentiality or integrity exposure and only partial/low availability degradation (CPU consumption and application stall rather than full crash). No EPSS score, CISA KEV listing, or public POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: this is a real but modest-priority issue - a classic ReDoS/algorithmic-complexity bug whose severity depends heavily on whether the consuming application exposes the Address6 parsing path to untrusted input. For most deployments it is a patch-on-schedule item rather than an emergency, with higher urgency only where ip-address parses user-supplied strings on a request-handling hot path.

An attacker submits a crafted input string containing a large number of '%' characters into an application field (for example an IPv6 zone/address value) that the application forwards to a function using the ip-address library's Address6 constructor. The quadratic-complexity parsing causes sustained CPU consumption and stalls the Node.js event loop, degrading or halting service for other users. No public proof-of-concept was identified in the provided data.