From e219ffcf715d2850422a40a16d5de4227430b537 Mon Sep 17 00:00:00 2001 From: SashaMIT Date: Tue, 11 Aug 2026 10:53:54 +0700 Subject: [PATCH 1/2] net: include 0.0.0.0/8 and ::/128 in BlockList.PRIVATE_RANGES PRIVATE_RANGES is documented as covering private, loopback, and link-local ranges used to block non-routable addresses. It already includes 127.0.0.0/8 and ::1/128 but omitted the IPv4 "this" network (0.0.0.0/8) and the IPv6 unspecified address (::/128), which are common alternate localhost spellings. --- doc/api/net.md | 2 ++ lib/internal/blocklist.js | 4 ++++ test/parallel/test-blocklist.js | 7 +++++++ 3 files changed, 13 insertions(+) diff --git a/doc/api/net.md b/doc/api/net.md index 81a25eee0f1b..3509b05dd81d 100644 --- a/doc/api/net.md +++ b/doc/api/net.md @@ -259,8 +259,10 @@ The included ranges are: * `10.0.0.0/8` — RFC 1918 private IPv4 * `172.16.0.0/12` — RFC 1918 private IPv4 * `192.168.0.0/16` — RFC 1918 private IPv4 +* `0.0.0.0/8` — IPv4 "this" network / unspecified (common localhost alias) * `127.0.0.0/8` — IPv4 loopback * `::1/128` — IPv6 loopback +* `::/128` — IPv6 unspecified * `169.254.0.0/16` — IPv4 link-local * `fe80::/10` — IPv6 link-local * `fc00::/7` — IPv6 unique local (ULA) diff --git a/lib/internal/blocklist.js b/lib/internal/blocklist.js index f290c7ada405..89a9e3132d08 100644 --- a/lib/internal/blocklist.js +++ b/lib/internal/blocklist.js @@ -85,9 +85,13 @@ class BlockList { '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', + // "This" network / IPv4 unspecified (often treated as localhost alias) + '0.0.0.0/8', // Loopback '127.0.0.0/8', '::1/128', + // IPv6 unspecified + '::/128', // Link-local '169.254.0.0/16', 'fe80::/10', diff --git a/test/parallel/test-blocklist.js b/test/parallel/test-blocklist.js index 08a293bb6a81..1d1e0097796d 100644 --- a/test/parallel/test-blocklist.js +++ b/test/parallel/test-blocklist.js @@ -814,6 +814,13 @@ const util = require('util'); assert(blockList.check('127.255.255.255')); assert(blockList.check('::1', 'ipv6')); + // IPv4 "this" network / unspecified (alternate localhost spellings) + assert(blockList.check('0.0.0.0')); + assert(blockList.check('0.0.0.1')); + + // IPv6 unspecified + assert(blockList.check('::', 'ipv6')); + // Link-local assert(blockList.check('169.254.0.1')); assert(blockList.check('fe80::1', 'ipv6')); From e8d6fbaa1882897a526935000e3e6bbe30395682 Mon Sep 17 00:00:00 2001 From: Sasha Mitchell Date: Tue, 11 Aug 2026 13:22:23 +0700 Subject: [PATCH 2/2] net: add CGNAT and benchmarking ranges to BlockList.PRIVATE_RANGES Include RFC 6598 (100.64.0.0/10) and RFC 2544 (198.18.0.0/15) so the helper matches common non-global IPv4 space used by carrier NAT and benchmarking labs. --- doc/api/net.md | 2 ++ lib/internal/blocklist.js | 4 ++++ test/parallel/test-blocklist.js | 6 ++++++ 3 files changed, 12 insertions(+) diff --git a/doc/api/net.md b/doc/api/net.md index 3509b05dd81d..fcc85d1c0de9 100644 --- a/doc/api/net.md +++ b/doc/api/net.md @@ -266,6 +266,8 @@ The included ranges are: * `169.254.0.0/16` — IPv4 link-local * `fe80::/10` — IPv6 link-local * `fc00::/7` — IPv6 unique local (ULA) +* `100.64.0.0/10` — RFC 6598 shared address space (CGNAT) +* `198.18.0.0/15` — RFC 2544 benchmarking methodology ```js const blockList = new net.BlockList(); diff --git a/lib/internal/blocklist.js b/lib/internal/blocklist.js index 89a9e3132d08..4a0b269e25e6 100644 --- a/lib/internal/blocklist.js +++ b/lib/internal/blocklist.js @@ -97,6 +97,10 @@ class BlockList { 'fe80::/10', // Unique local (ULA) 'fc00::/7', + // RFC 6598 - Shared Address Space / Carrier-Grade NAT + '100.64.0.0/10', + // RFC 2544 - Benchmarking Methodology (commonly non-routable lab space) + '198.18.0.0/15', ]); [kInspect](depth, options) { diff --git a/test/parallel/test-blocklist.js b/test/parallel/test-blocklist.js index 1d1e0097796d..ea65f5f736a0 100644 --- a/test/parallel/test-blocklist.js +++ b/test/parallel/test-blocklist.js @@ -829,6 +829,12 @@ const util = require('util'); assert(blockList.check('fc00::1', 'ipv6')); assert(blockList.check('fd00::1', 'ipv6')); + // CGNAT (RFC 6598) and benchmarking (RFC 2544) + assert(blockList.check('100.64.0.1')); + assert(blockList.check('100.127.255.255')); + assert(blockList.check('198.18.0.1')); + assert(blockList.check('198.19.255.255')); + // Public addresses should not match assert(!blockList.check('8.8.8.8')); assert(!blockList.check('1.1.1.1'));