CVE-2026-101911 describes a vulnerability in the ip-address JavaScript library affecting versions before 10.7.1. The Address6 constructor, Address6.isValid method, and parsing code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. This can lead to uncontrolled resource consumption when very large attacker-controlled inputs are parsed without prior length checks. Typical URL, header, and body-parser size limits usually prevent exploitation. However, megabyte-scale inputs can cause synchronous stalls, high transient memory usage (~16 MiB triggers invalid string length exceptions, ~32 MiB causes process termination). The vulnerability is resolved in version 10.7.1.

An attacker can cause denial of service by supplying very large IPv6 address strings that trigger excessive memory allocation and synchronous stalls during parsing. This can lead to process crashes or termination. The impact is limited by common input size restrictions in typical applications. There is no indication of remote code execution or data leakage. No known exploits in the wild have been reported.

Upgrade to ip-address version 10.7.1 or later, where this vulnerability is fixed. Additionally, ensure that applications impose reasonable length limits on inputs passed to Address6 parsing functions to prevent processing of excessively large strings.