ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

影響: npm:ip-address <= 10.7.3 → 10.7.4

new Address6() and Address6.isValid() strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 % characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same s…

GitHub Advisory Databaseで読む

2026/10/23 01:19、GitHub Advisory Databaseが「ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-111997。