{"record":{"id":"39142bad3086dbf3","repo":"valyala/fasthttp","slug":"invalid-ipv6-host","errorCode":null,"errorMessage":"invalid ipv6 host","messagePattern":"invalid ipv6 host","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ipv6.go","lineNumber":9,"sourceCode":"package fasthttp\n\nimport (\n\t\"bytes\"\n\t\"errors\"\n)\n\nvar (\n\terrInvalidIPv6Host    = errors.New(\"invalid ipv6 host\")\n\terrInvalidIPv6Zone    = errors.New(\"invalid ipv6 zone\")\n\terrInvalidIPv6Address = errors.New(\"invalid ipv6 address\")\n)\n\nfunc validateIPv6Literal(host []byte) error {\n\tif len(host) == 0 || host[0] != '[' {\n\t\treturn nil\n\t}\n\tend := bytes.IndexByte(host, ']')\n\tif end < 0 || end == 1 {\n\t\treturn errInvalidIPv6Host\n\t}\n\taddr := host[1:end]\n\n\t// Optional zone.\n\tif zi := bytes.IndexByte(addr, '%'); zi >= 0 {\n\t\tif zi == len(addr)-1 {\n\t\t\treturn errInvalidIPv6Zone","sourceCodeStart":1,"sourceCodeEnd":27,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/ipv6.go#L1-L27","documentation":"validateIPv6Literal rejects an IPv6 host literal that is not properly bracketed or is otherwise structurally invalid. errInvalidIPv6Host is returned when the host starts with '[' (IPv6 literal form) but the bracketed host fails basic host-level validation.","triggerScenarios":"Calling URI host parsing/normalization (e.g. uri.parseHost, Host normalization paths) with a Host header or request URI host like '[::1' (missing closing bracket) or '[]'.","commonSituations":"Hand-crafted Host headers missing a closing bracket; proxies forwarding mangled Host values; constructing URIs by string concatenation and forgetting brackets around IPv6 addresses.","solutions":["Wrap IPv6 hosts in brackets including the closing one: use host '[::1]' not '::1' or '[::1'.","Use uri.SetHost / URI.SetHost or URI.Parse with a full URL (http://[::1]:8080/) so fasthttp validates for you.","Sanitize/normalize the Host header before forwarding if you are a proxy."],"exampleFix":"// before\nreq.SetRequestURI(\"http://[::1]:8080/\") // ok, but hand-built host below is not\nreq.Header.SetHost(\"[::1\") // invalid ipv6 host\n// after\nreq.Header.SetHost(\"[::1]\")","handlingStrategy":"validation","validationCode":"func validIPv6Literal(host string) bool {\n    if !strings.HasPrefix(host, \"[\") || !strings.HasSuffix(host, \"]\") || len(host) < 4 {\n        return false\n    }\n    inner := host[1 : len(host)-1]\n    if i := strings.IndexByte(inner, '%'); i >= 0 {\n        inner = inner[:i]\n    }\n    return net.ParseIP(inner) != nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always bracket IPv6 hosts including the closing ']'.","Use URI.Parse with absolute URLs instead of manual host assembly.","Validate Host headers at proxy boundaries."],"tags":["ipv6","uri","host-header"],"backgroundTag":"invalid-ipv6-literal","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}