Skip to main content

ip-address EUVDEUVD-2026-88395

| CVE-2026-101911 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-09-28 GitHub_M GHSA-h3mg-xc3c-68pw
Denial Of Service JavaScript npm Ip Address
6.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

Network-reachable and unauthenticated, but AC:H because impact needs an atypical 16-32 MiB input path that default size limits usually block; availability-only, transient, so A:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Patch available
Sep 28, 2026 - 19:01 EUVD
Metadata Corrected
Sep 28, 2026 - 18:40 vuln.today
tag: JavaScript added
Metadata Corrected
Sep 28, 2026 - 18:40 vuln.today
tag: npm added
Analysis Generated
Sep 28, 2026 - 18:22 vuln.today
CVE Published
Sep 28, 2026 - 17:46 cve.org
MEDIUM 6.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on ip-address (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.7.1.

DescriptionCVE.org

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.

AnalysisAI

Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or crash a Node.js process by supplying megabyte-scale strings to the IPv6 parsing paths - the Address6 constructor, Address6.isValid, and the underlying parse routine in src/ipv6.ts. An application is only exposed if it accepts an attacker-controlled field of roughly 16 MiB or more and passes it to those entry points without an earlier length bound; common URL, HTTP header, and default body-parser limits keep inputs well below the ~32 MiB needed to terminate the process, so default configurations typically exclude the impact and this is assessed as a low-to-moderate real-world risk that does not warrant emergency prioritization. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the consuming application (a) accepts an attacker-controlled field of megabyte scale - approximately 16 MiB to trigger an invalid-string-length exception and approximately 32 MiB to cause process termination - and (b) passes that field to Address6 construction, Address6.isValid, or the underlying parse path in src/ipv6.ts WITHOUT enforcing an earlier length bound. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a low-to-moderate real-world risk that does not warrant emergency prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: 10.7.1 - upgrade ip-address to 10.7.1 or later (npm install ip-address@^10.7.1), verify the resolved version in your lockfile, and rebuild/redeploy any service with a bundled dependency; details are in the release notes at https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1 and the advisory at https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in JavaScript

View all
CVE-2026-102827 CRITICAL POC
9.8 Sep 29

Command injection in simple-git, the Node.js library for running git commands and published on npm, affects all releases
CVE-2026-77615 HIGH POC
8.7 Sep 17

Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allo
CVE-2026-92776 HIGH POC
8.6 Sep 16

Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one
CVE-2026-102826 HIGH POC
8.1 Sep 29

Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary command
CVE-2026-85715 HIGH POC
7.5 Sep 17

Improper memory allocation control in ExifReader before 4.41.1 allows remote attackers to exhaust heap memory and termin
CVE-2026-102278 HIGH POC
7.5 Sep 28

Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack a
CVE-2026-102276 HIGH POC
7.5 Sep 28

Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a craf
CVE-2026-92775 HIGH POC
7.1 Sep 16

Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions for
CVE-2026-101910 MEDIUM POC
6.9 Sep 28

The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applicat
CVE-2026-101914 MEDIUM POC
6.5 Sep 28

Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one

CVE-2026-101912 MEDIUM POC
6.3 Sep 28

Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHo
CVE-2026-57141 CRITICAL
9.8 Sep 15

Remote code execution in the PraisonAI TypeScript `codeMode` tool (npm package `praisonai` <= 1.7.1) lets an attacker wh

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-88395 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy