[RihanArfan]

🔗 Linked issue

Closes #4205

❓ Type of change

• 📖 Documentation (updates to the documentation, readme, or JSdoc annotations)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

Dual-stack Node sockets report loopback connections as ::ffff:127.0.0.1 RFC 4291), which caused the VFS handler to return 403 on platforms like. Strip the ::ffff: prefix before the loopback check.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nitro.build	Ready	Preview, Comment	Apr 17, 2026 11:08am

[coderabbitai]

📝 Walkthrough

Walkthrough

The change normalizes IPv4-mapped IPv6 addresses in request IP resolution by stripping the ::ffff: prefix, and updates loopback detection to validate against both IPv6 loopback (::1) and IPv4 loopback (127.x.y.z) patterns on normalized values.

Changes

Cohort / File(s)	Summary
IPv6 IPv4-mapped address normalization src/dev/vfs.ts	Added logic to strip ::ffff: prefix (case-insensitive) from resolved request IPs and updated local-request detection regex to match both IPv6 and IPv4 loopback addresses against the normalized value.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is related to the changeset, referencing the specific issue and explaining the IPv4-mapped IPv6 loopback problem that the fix addresses.
Linked Issues check	✅ Passed	The PR implementation directly addresses issue #4205 by normalizing IPv4-mapped IPv6 loopback addresses in the VFS handler to allow localhost checks to succeed.
Out of Scope Changes check	✅ Passed	All changes in src/dev/vfs.ts are scoped to fixing the IPv4-mapped IPv6 loopback issue identified in #4205 with no extraneous modifications.
Title check	✅ Passed	The PR title follows conventional commits format (fix prefix) and accurately describes the main change: accepting IPv4-mapped IPv6 loopback addresses in the VFS handler.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/vfs-ipv4-mapped-ipv6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4212

commit: dfb1193