Denial of Service in ip-address via Address6 Constructor

Executive Summary

This vulnerability affects the npm package ip-address versions 10.7.3 and earlier. It involves a regular expression in the Address6 constructor and isValid() method that strips zone identifiers from IPv6 addresses. Due to a lack of anchoring in the regex pattern, processing strings with many '%' characters followed by a line terminator causes quadratic time complexity, leading to significant delays.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses the vulnerable ip-address package versions 10.7.3 or earlier. Run npm list ip-address to verify the installed version. If affected, test inputs with many % characters followed by a newline to observe delays in processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service by consuming CPU resources and stalling applications. For example, processing 100,000 '%' characters with a newline takes 3.9 seconds, blocking the event loop. It can be exploited via large request bodies, as HTTP headers cannot carry raw line terminators.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires ensuring availability of processing systems, while HIPAA mandates safeguards against disruptions. The CPU consumption and application stall caused by this flaw could lead to prolonged downtime, violating these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the ip-address package to version 10.7.4 or later. As a temporary measure, implement input length checks to reject strings longer than 64 characters. Monitor system performance for unexpected delays during input processing.

Useful 0 Not Useful 0