The vulnerability resides in the Address6 constructor and validation logic of the ip-address JavaScript library. Unbounded input strings trigger the diagnostic routine RE_BAD_CHARACTERS to expand every invalid character, which scales linearly with the input length. When a maliciously long IPv6 string is parsed, the library allocates large temporary buffers, ultimately causing a synchronous stall, memory exhaustion, or an exception that terminates the process. The impact is limited to memory use and uptime; the library does not provide arbitrary code execution, so the primary effect is a denial of service.

The affected product is the ip-address library produced by beaugunderson. All releases prior to version 10.7.1 contain the flaw. Any JavaScript application that accepts IPv6 addresses—such as web servers, network utilities, or middleware—may be affected when it passes user-supplied data to Address6 without first restricting its length.

With a CVSS score of 6.3, the vulnerability is classified as medium severity. No EPSS score is available, and it is not listed in the CISA KEV catalog, indicating a lower but nonzero likelihood of exploitation. The attack requires delivery of an oversized or malformed IPv6 string, which can normally be constrained by URL, header, or body parsing limits common in HTTP frameworks. If an application accepts larger payloads—approaching or exceeding 32 MiB—an attacker could force the Address6 parser to stall or crash, yielding a denial of service. The risk is therefore moderate, driven primarily by the need to bypass typical input size controls.