{"id":"ghsa-ghsa-rxp7-6hxx-x8q5","seq":309580,"kind":"advisory","title":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","url":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","permalink":"https://vulnpulse.app/items/ghsa-ghsa-rxp7-6hxx-x8q5","summary":"影響: npm:ip-address <= 10.7.3 → 10.7.4\nnew Address6() and Address6.isValid() strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 % characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same s…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-111997"],"tags":["GHSA-rxp7-6hxx-x8q5","ip-address"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:19:39.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}