Skip to content

Do not split dotted IPv6 hosts in req.subdomains - #7558

Closed
light1563 wants to merge 1 commit into
expressjs:masterfrom
light1563:fix-7532-subdomains-ipv6
Closed

light1563 wants to merge 1 commit into
expressjs:masterfrom
light1563:fix-7532-subdomains-ipv6

Conversation

@light1563

Copy link
Copy Markdown

Problem

req.subdomains splits any dotted host on ., but an IPv6 literal can legitimately contain dots — for example the IPv4-mapped address [::ffff:127.0.0.1]. The bracketed host fails the isIP() check (which does not accept brackets), so it is treated as a hostname and shredded:

// Host: [::ffff:127.0.0.1]
req.subdomains // → ["0", "[::ffff:127"]  (with the default subdomain offset)

[::1] worked only by accident, because it contains no dots.

Fix

Strip the surrounding brackets of an IPv6 literal before the isIP() check so the host is recognized as an IP address and never split. The IP branch keeps returning the hostname as-is, so behavior for [::1] and plain IPv4/IPv6 hosts is unchanged.

Tests

Added a case for Host: [::ffff:127.0.0.1] → [] in test/req.subdomains.js; the existing IPv4/IPv6/hostname cases are unchanged.

Fixes #7532.

@krzysdz

krzysdz commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Duplicate of #7533

@krzysdz krzysdz marked this as a duplicate of #7533 Oct 25, 2026
@krzysdz krzysdz closed this Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

req.subdomains splits an IPv6 host that contains dots

2 participants