Follow Discord
Sweep 22 Sep 2026 · 17:19Z Build v2.1.280 501 read Stable v2.1.267 Latest v2.1.280 Next v2.1.280 Feeds RSS JSON llms.txt Unofficial
Claude Code v2.1.277 ·

SSRF/private-IP check for local tooling simplified and a normalization step added

The check for whether an address is local was simplified and now strips IPv6 zone identifiers first

TierUnder the hoodhow much it should matter to you
Useful1my rating, 1 to 5
Signal1worth watching, 1 to 5
AreaSandboxwhat it touches
KindInternal Changesin v2.1.277,
Under the hood

The check for whether an address is local was simplified and now strips IPv6 zone identifiers first

What

Claude Code has an internal check for whether a network address counts as "local," used to control whether local tools can bind to it. This check now strips IPv6 zone identifiers (extra suffixes like %eth0 sometimes attached to IPv6 addresses) before evaluating an address. It also consolidates loopback and unspecified-address handling into a single computed result, and hands off unmatched cases to a new helper function instead of separately hardcoding checks for AWS and GCP metadata service IP addresses.

Why

This is a defensive check related to preventing server-side request forgery (SSRF), where a request is tricked into reaching an unintended internal address; normalizing IPv6 zone identifiers first helps make sure such addresses aren't misclassified and slip past the local-address check.

See this entry in the whole of v2.1.277 →

Feedback