Skip to content

fix: check IPv6 AAAA records in DNS rebinding protection (#668)#713

Closed
stedfn wants to merge 1 commit intogarrytan:mainfrom
stedfn:stedfn/fix-ipv6-dns-rebinding
Closed

fix: check IPv6 AAAA records in DNS rebinding protection (#668)#713
stedfn wants to merge 1 commit intogarrytan:mainfrom
stedfn:stedfn/fix-ipv6-dns-rebinding

Conversation

@stedfn
Copy link
Copy Markdown
Contributor

@stedfn stedfn commented Mar 31, 2026

Summary

  • resolvesToBlockedIp() now checks both A (IPv4) and AAAA (IPv6) records in parallel
  • Each resolution has its own .catch(() => []) so a failure in one doesn't skip the other
  • Prevents DNS rebinding attacks via IPv6 AAAA records pointing to metadata IPs

Fixes #668

Test plan

  • bun test passes
  • bun run build succeeds

🤖 Generated with Claude Code

resolvesToBlockedIp() now resolves both A and AAAA records in parallel,
each with its own .catch() so a failure in one doesn't skip the other.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@stedfn
Copy link
Copy Markdown
Contributor Author

stedfn commented Mar 31, 2026

Closing — PR #664 already addresses #668 as part of a larger security omnibus fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] DNS rebinding protection only checks IPv4 — IPv6 AAAA records bypass

1 participant