Addresses blocked even when allowPrivateIp is on. Cloud metadata services
(AWS/GCP/Azure IMDS) live at 169.254.169.254 and would exfiltrate
credentials if a CI runner or long-lived server followed an attacker URL to
them. IPv6 link-local (fe80::/10) is the v6 equivalent reach into the
host's local segment. Deterministic IPv4 wrappers block their encoded IMDS
ranges; opaque local-translation and Teredo prefixes fail closed because
their ultimate destination cannot be classified safely here.
Addresses blocked even when
allowPrivateIpis on. Cloud metadata services (AWS/GCP/Azure IMDS) live at 169.254.169.254 and would exfiltrate credentials if a CI runner or long-lived server followed an attacker URL to them. IPv6 link-local (fe80::/10) is the v6 equivalent reach into the host's local segment. Deterministic IPv4 wrappers block their encoded IMDS ranges; opaque local-translation and Teredo prefixes fail closed because their ultimate destination cannot be classified safely here.Returns
falsefor non-IP inputs (hostnames).