ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

影響: npm:ip-address <= 10.7.3 → 10.7.4

new Address6() and Address6.isValid() strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 % characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same s…

在 GitHub Advisory Database 阅读

2026/10/23 01:19，GitHub Advisory Database 发布了“ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-111997。