CVE-2026-111997

What it actually does

Denial of service via quadratic complexity CPU consumption and application stall when the Address6 constructor processes input containing many percent characters.

Why it matters to the business

Applications or services using the vulnerable library can become unresponsive under crafted input, causing temporary service disruption; low exploitability and absence from known exploited lists reduce immediate urgency but require prompt patching given recent disclosure.

How an attack unfolds

An attacker supplies a malicious string with a high number of percent characters to any code path invoking the Address6 constructor, triggering repeated expensive operations that consume CPU and stall the process.

How to fix it

Upgrade the ip-address package to version 10.7.4 or later in all affected codebases and dependency trees.

How to confirm the fix worked

Verify the installed version is 10.7.4 or newer; test parsing functions with inputs containing large numbers of percent characters and confirm CPU usage remains linear.

Typical attack path

1. Identify an entry point that accepts untrusted input and passes it to ip-address parsing functions
2. Craft a payload consisting of repeated percent characters
3. Submit the payload to trigger the Address6 constructor
4. Observe sustained high CPU usage and application stall

How to detect it

Review application and web server logs for unusually long or repetitive percent-encoded strings reaching address parsing code; correlate with process CPU utilization spikes.

What your security team should do

• Inventory all direct and transitive uses of ip-address and schedule upgrades to 10.7.4+
• Add dependency scanning rules to block future vulnerable versions
• Monitor for unusual CPU spikes on services that parse network addresses