# is-loopback-addr

> Check if a IP address is a loopback address

Latest version **2.1.0** (published 2026-08-11) · MIT license · 0 weekly downloads

## Install

```sh
npm install is-loopback-addr
pnpm add is-loopback-addr
yarn add is-loopback-addr
bun add is-loopback-addr
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 2.1.0 |
| Published | 2026-08-11 |
| First published | 2020-10-07 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM |
| Dependencies | 0 |
| Unpacked size | 10.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 5 |
| Author | Vasco Santos |
| Maintainers | vascosantos |

## Links

- npm: https://www.npmjs.com/package/is-loopback-addr
- Repository: https://github.com/vasco-santos/is-loopback-addr
- Homepage: https://github.com/vasco-santos/is-loopback-addr#readme
- Issues: https://github.com/vasco-santos/is-loopback-addr/issues
- npm.io page: https://npm.io/package/is-loopback-addr

## Recent versions

- 2.1.0 (latest) — 2026-08-11
- 2.0.2 — 2023-08-14
- 2.0.1 — 2022-01-12
- 2.0.0 — 2022-01-12
- 1.0.1 — 2020-10-10
- 1.0.0 — 2020-10-07

## README

# is-loopback-addr

[![Build Status](https://github.com/vasco-santos/is-loopback-addr/actions/workflows/js-test-and-release.yml/badge.svg?branch=main)](https://github.com/vasco-santos/is-loopback-addr/actions/workflows/js-test-and-release.yml)
[![dependencies Status](https://david-dm.org/vasco-santos/is-loopback-addr/status.svg)](https://david-dm.org/vasco-santos/is-loopback-addr)
[![JavaScript Style Guide](https://img.shields.io/badge/code_style-standard-brightgreen.svg)](https://standardjs.com)
[![Downloads](https://img.shields.io/npm/dm/is-loopback-addr.svg)](https://www.npmjs.com/package/is-loopback-addr)
[![Minzipped size](https://badgen.net/bundlephobia/minzip/is-loopback-addr)](https://bundlephobia.com/result?p=is-loopback-addr)
[![codecov](https://img.shields.io/codecov/c/github/vasco-santos/is-loopback-addr.svg?style=flat-square)](https://codecov.io/gh/vasco-santos/is-loopback-addr)

> Check if a IP address is a loopback address

Various Internet Engineering Task Force ([IETF](https://www.ietf.org/)) standards reserve the IPv4 address block `127.0.0.0/8` and the IPv6 address `::1/128` for this purpose. The most common IPv4 address used is 127.0.0.1. Commonly these loopback addresses are mapped to the hostnames, localhost or loopback. For more information check [rfc5735](https://tools.ietf.org/html/rfc5735) and [rfc3513](https://tools.ietf.org/html/rfc3513#section-2.4).

This checks whether a **string is a loopback address literal**, per `127.0.0.0/8` and `::1/128`. It accepts any spelling the platform URL parser canonicalises into those ranges, which includes `127.1`, `2130706433`, `0x7f000001` and `0177.0.0.1`. Hostnames are never resolved: `localhost` is `false`, and `::ffff:127.0.0.1` is `false` because it is in neither range.

**This is not an SSRF filter.** It classifies literals by RFC range. It does not know about DNS, redirects, IPv4-mapped addresses or any other route to the loopback interface, and it should not be the only check between untrusted input and an outbound request.

## Install

```sh
npm i is-loopback-addr
```

## Usage

```js
import { isLoopbackAddr } from 'is-loopback-addr'

console.log(isLoopbackAddr('127.0.0.1')) // true
console.log(isLoopbackAddr('192.168.0.1')) // false
console.log(isLoopbackAddr('22.2.0.1')) // false
console.log(isLoopbackAddr('::1')) // true
console.log(isLoopbackAddr('2001:8a0:7ac5:4201:3ac9:86ff:fe31:7095')) // false
```

## Contribute

Feel free to dive in! [Open an issue](https://github.com/vasco-santos/is-loopback-addr/issues/new) or submit PRs.

## License

[MIT](LICENSE) © Vasco Santos

---
_Source: https://npm.io/package/is-loopback-addr · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._