AIKIDO-2026-888678
ip-address is vulnerable to Denial of Service (DoS)
63
Medium Risk
This Affects:
ip-addressTL;DR
Address6 parsing diagnostics process the full input string before validating its length, so an excessively long string forces Address6 and Address6.isValid() to perform work far beyond any well-formed IPv6 address. Untrusted, length-unbounded input can cause disproportionate CPU and memory use, degrading or crashing the process. The fix rejects overlong input before parsing; the corresponding IPv4 length guard is preventive hardening because Address4 did not use the vulnerable diagnostic path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass untrusted, length-unbounded input to Address6 or Address6.isValid().
Background info
ip-address is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 10.7.0.
How to fix this
Upgrade the ip-address library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.