fix(ssrf): block NAT64 and IPv4-compatible IPv6 literals

[devin-ai-integration]

Summary

Fixes an SSRF blocklist gap: isBlockedV6 decoded embedded IPv4 only for the ::ffff: prefix, so NAT64 (64:ff9b::/96) and deprecated IPv4-compatible (::a.b.c.d) literals like http://[64:ff9b::7f00:1] passed the guard and — on networks with NAT64/DNS64 translation — could reach internal IPv4 addresses (e.g. 127.0.0.1) that the IPv4 blocklist would refuse.

Replaced the ad-hoc regex checks with a canonical parse-then-match approach:

• parseV6 expands any IPv6 literal (including :: compression and trailing dotted-quad) into 8 16-bit words; unparseable input is treated as blocked.
• BLOCKED_V6_RULES is a CIDR-based blocklist over those words, keeping all previously blocked ranges and adding ::/96 (IPv4-compatible), 64:ff9b::/96 (NAT64 well-known), 64:ff9b:1::/48 (NAT64 local-use), and 100::/64 (discard-only).
• Rules with embeddedV4: true (::/96, ::ffff:0:0/96, 64:ff9b::/96) map the embedded IPv4 from the last 32 bits back through isBlockedV4, so private/reserved embedded addresses are rejected while public ones (e.g. 64:ff9b::8.8.8.8) remain allowed.

Tests extended with reject cases (64:ff9b::7f00:1, 64:ff9b::127.0.0.1, ::127.0.0.1, ::7f00:1, ::ffff:7f00:1, 64:ff9b:1::1, 100::1) and public-embedded allow cases.

Remediates finding sfind-b7e6add3e60c41d3b096f3c47be16752.

Link to Devin session: https://app.devin.ai/sessions/6206628cc75144ce9f5d3f2c98f05ddd
Requested by: @tinkthemaker

Summary by CodeRabbit

• Bug Fixes
  • Improved protection against requests to restricted IPv6 addresses.
  • Added coverage for private, multicast, documentation, mapped, and embedded IPv4 address ranges.
  • Invalid IPv6 addresses are now blocked consistently.
  • Public IPv4 addresses embedded in IPv6 literals remain accessible.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cyber-toolbox	Ready	Preview	Aug 19, 2026 3:19am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b25ad70c-7c13-48c9-a92e-545aa9c57640

📥 Commits

Reviewing files that changed from the base of the PR and between bf38289 and 349b66f.

📒 Files selected for processing (2)

• lib/security/ssrf.ts
• tests/security/ssrf.test.ts

Included review availability: Your plan provides up to 3 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

IPv6 SSRF validation now parses compressed and embedded forms, applies declarative CIDR rules, blocks invalid addresses, and delegates embedded IPv4 checks to existing IPv4 logic. Tests cover additional blocked ranges and public IPv4 embeddings.

Changes

IPv6 SSRF validation

Layer / File(s)	Summary
IPv6 parsing and CIDR rules lib/security/ssrf.ts	The validator parses IPv6 groups and embedded dotted IPv4 forms. Declarative rules cover reserved, private, multicast, documentation, and related ranges. Embedded IPv4 addresses use IPv4 validation.
IPv6 behavior tests tests/security/ssrf.test.ts	Tests cover additional blocked IPv6 ranges and allow IPv6 literals that embed public IPv4 addresses.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 349b6

The change blocks additional IPv6 forms that could reach restricted IPv4 destinations while preserving allowed public destinations; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: blocking NAT64 and IPv4-compatible IPv6 literals in the SSRF guard.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch devin/1787109527-ipv6-ssrf-nat64

---

_{Comment @coderabbitai help to get the list of available commands.}