SnapOtterandGitHub f75cc328ac fix(security): numeric CIDR matching for IPv6 SSRF allow/deny ...

Replace textual prefix matching in isPrivateIPv6() with numeric bit-prefix matching via ipaddr.js. Closes reachable classifier bypasses for IPv4-compatible IPv6 (::a.b.c.d), site-local fec0::/10, and the full fe80::/10 link-local span, on top of the IPv4-mapped forms. Embedded IPv4 (mapped and compatible) is run through the full isPrivateIPv4 classifier; unparseable input fails closed.

Follow-up hardening to f64cbdda.

Reported-by: tonghuaroot

2026-06-21 23:20:28 +08:00

..

api

fix(security): numeric CIDR matching for IPv6 SSRF allow/deny

2026-06-21 23:20:28 +08:00

demo

feat!: SnapOtter 2.0.0

2026-06-17 14:33:09 +08:00

docs

feat(modality): rename "file" modality label "Data" -> "Files"

2026-06-21 02:45:56 +08:00

landing

fix(e2e): disable Astro Dev Toolbar during landing e2e tests

2026-06-21 12:13:48 +08:00

web

feat(modality): rename "file" modality label "Data" -> "Files"

2026-06-21 02:45:56 +08:00