ip.cidrSubnet('efef::efef::/64').contains('::1') returns true

[mkg20001]

This shouldn't be right I think

Additionally since the address has two :: I think it's invalid, too

Test in REPL:

const ip=require('ip')
ip.cidrSubnet('efef::efef::/64').contains('::1')

[gregmartyn]

also the localhost ipv6 address cidr matches other addresses:
cidrSubnet('::1/128').contains('192.168.0.1') === true
and
cidrSubnet('::1/128').contains('::ffff:172.19.0.1') === true