Skip to content

fix: don't split a bracketed IPv6 host in req.subdomains - #7540

Closed
XRafik wants to merge 1 commit into
expressjs:masterfrom
XRafik:fix/subdomains-dotted-ipv6
Closed

XRafik wants to merge 1 commit into
expressjs:masterfrom
XRafik:fix/subdomains-dotted-ipv6

Conversation

@XRafik

@XRafik XRafik commented Oct 21, 2026

Copy link
Copy Markdown

req.hostname keeps the brackets of an IPv6 literal (e.g. [::ffff:127.0.0.1]), and net.isIP() returns 0 for the bracketed form — so the host fell into the domain branch and got split on its dots, producing ["0", "[::ffff:127"] instead of []. Detect the brackets and keep the literal as a single unit.

  • req.subdomains now treats any bracketed hostname as one unit, never split on dots
  • IPv4, [::1], domain hosts, and subdomain offset behavior are unchanged (existing tests pass)
  • added two regression tests for the dotted-IPv6 case at default and offset 0

Closes #7532

req.hostname keeps the brackets of an IPv6 literal (e.g. [::ffff:127.0.0.1]),
and net.isIP() returns 0 for the bracketed form, so the host fell into the
domain branch and was split on its dots, giving ["0", "[::ffff:127"]
instead of []. Detect the brackets and keep the literal as a single unit.

Closes expressjs#7532
@krzysdz

krzysdz commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Duplicate of #7533

@krzysdz krzysdz marked this as a duplicate of #7533 Oct 21, 2026
@krzysdz krzysdz closed this Oct 21, 2026
@XRafik

XRafik commented Oct 23, 2026

Copy link
Copy Markdown
Author

Right, #7533 beat me to it by a day — same fix either way. Thanks for the quick review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

req.subdomains splits an IPv6 host that contains dots

2 participants