Hi! 🙂 req.subdomains splits an IPv6 host that contains dots.

Environment information

Version: express 5.3.0 (4.22.3 gives the same result)

Platform: Darwin 27.0.0

Node.js version: v24.21.0

Any other relevant information: None.

What steps will reproduce the bug?

req.subdomains does not split a host that is an IP address. This works for [::1]. An IPv6 address can also contain dots, for example the IPv4-mapped address [::ffff:127.0.0.1]. req.subdomains splits that host on the dots:

const express = require('express')
const app = express()

app.get('/', (req, res) => res.json(req.subdomains))
app.listen(3000)

curl -H 'Host: [::1]' http://localhost:3000/
# []

curl -H 'Host: [::ffff:127.0.0.1]' http://localhost:3000/
# ["0","[::ffff:127"]

Full repro, with npm run repro: https://github.com/johnnyhuirilef/expressjs-repros/tree/main/subdomains-ipv6-dotted-host

Note: fetch() rewrites the host to [::ffff:7f00:1], so it does not show the bug. curl, http.get() and X-Forwarded-Host (with trust proxy) send the host as written.

What is the expected behavior?

[] for [::ffff:127.0.0.1], the same as for [::1]. With subdomain offset set to 0, the expected value is ["[::ffff:127.0.0.1]"].

What do you see instead?

["0","[::ffff:127"]. With subdomain offset set to 0: ["1]","0","0","[::ffff:127"].

Additional information

req.hostname keeps the brackets of an IPv6 literal. req.subdomains passes that value to net.isIP() in lib/request.js, and isIP('[::ffff:127.0.0.1]') returns 0. The existing [::1] test passes only because that address has no dots.

I have a fix with tests. Happy to open a PR 🙌