## ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-111997
- 公開日時: 2026-10-22T16:19:39.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-rxp7-6hxx-x8q5)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-rxp7-6hxx-x8q5

影響: npm:ip-address <= 10.7.3 → 10.7.4
new Address6() and Address6.isValid() strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 % characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same s…