diff --git a/main/fastcgi.c b/main/fastcgi.c
index 18eb4b394bc..606faeea43d 100644
--- a/main/fastcgi.c
+++ b/main/fastcgi.c
@@ -1340,7 +1340,7 @@ static int fcgi_is_allowed(void) {
 	if (client_sa.sa.sa_family == AF_INET6) {
 		for (i = 0; allowed_clients[i].sa.sa_family ; i++) {
 			if (allowed_clients[i].sa.sa_family == AF_INET6
-				&& !memcmp(&client_sa.sa_inet6.sin6_addr, &allowed_clients[i].sa_inet6.sin6_addr, 12)) {
+				&& !memcmp(&client_sa.sa_inet6.sin6_addr, &allowed_clients[i].sa_inet6.sin6_addr, sizeof(client_sa.sa_inet6.sin6_addr))) {
 				return 1;
 			}
 #ifdef IN6_IS_ADDR_V4MAPPED
diff --git a/sapi/fpm/tests/ghsa-62xp-839h-2637-ipv6-allowed-clients.phpt b/sapi/fpm/tests/ghsa-62xp-839h-2637-ipv6-allowed-clients.phpt
new file mode 100644
index 00000000000..c72f9bcdcc5
--- /dev/null
+++ b/sapi/fpm/tests/ghsa-62xp-839h-2637-ipv6-allowed-clients.phpt
@@ -0,0 +1,52 @@
+--TEST--
+GHSA-62xp-839h-2637: IPv6 allowed client compared on all 128 bits
+--SKIPIF--
+<?php
+include "skipif.inc";
+FPM\Tester::skipIfIPv6IsNotSupported();
+?>
+--FILE--
+<?php
+
+require_once "tester.inc";
+
+$cfg = <<<EOT
+[global]
+error_log = {{FILE:LOG}}
+[exact]
+listen = {{ADDR:IPv6:ANY[exact]}}
+listen.allowed_clients = ::1
+pm = static
+pm.max_children = 1
+[prefix]
+listen = {{ADDR:IPv6:ANY[prefix]}}
+listen.allowed_clients = ::dead:beef
+pm = static
+pm.max_children = 1
+catch_workers_output = yes
+EOT;
+
+$tester = new FPM\Tester($cfg);
+$tester->start();
+$tester->expectLogStartNotices();
+$tester->checkRequest('{{ADDR:IPv6[exact]}}', 'exact: ok', 'exact: error');
+$tester->checkRequest('{{ADDR:IPv6[prefix]}}', 'prefix: ok', 'prefix: error');
+$tester->terminate();
+$tester->expectLogWarning(
+    'child %d said into stderr: "ERROR: Connection disallowed: IP address \'::1\' has been dropped."',
+    'prefix'
+);
+$tester->expectLogTerminatingNotices();
+$tester->close();
+
+?>
+Done
+--EXPECT--
+exact: ok
+prefix: error
+Done
+--CLEAN--
+<?php
+require_once "tester.inc";
+FPM\Tester::clean();
+?>
diff --git a/sapi/fpm/tests/ghsa-62xp-839h-2637-v4mapped-allowed-clients.phpt b/sapi/fpm/tests/ghsa-62xp-839h-2637-v4mapped-allowed-clients.phpt
new file mode 100644
index 00000000000..1bbb7c16585
--- /dev/null
+++ b/sapi/fpm/tests/ghsa-62xp-839h-2637-v4mapped-allowed-clients.phpt
@@ -0,0 +1,52 @@
+--TEST--
+GHSA-62xp-839h-2637: IPv4-mapped allowed client compared on all 128 bits
+--SKIPIF--
+<?php
+include "skipif.inc";
+FPM\Tester::skipIfIPv6IsNotSupported();
+?>
+--FILE--
+<?php
+
+require_once "tester.inc";
+
+$cfg = <<<EOT
+[global]
+error_log = {{FILE:LOG}}
+[exact]
+listen = {{ADDR:IPv6:ANY[exact]}}
+listen.allowed_clients = ::ffff:127.0.0.1
+pm = static
+pm.max_children = 1
+[prefix]
+listen = {{ADDR:IPv6:ANY[prefix]}}
+listen.allowed_clients = ::ffff:203.0.113.1
+pm = static
+pm.max_children = 1
+catch_workers_output = yes
+EOT;
+
+$tester = new FPM\Tester($cfg);
+$tester->start();
+$tester->expectLogStartNotices();
+$tester->checkRequest('{{ADDR:IPv4[exact]}}', 'exact: ok', 'exact: error');
+$tester->checkRequest('{{ADDR:IPv4[prefix]}}', 'prefix: ok', 'prefix: error');
+$tester->terminate();
+$tester->expectLogWarning(
+    'child %d said into stderr: "ERROR: Connection disallowed: IP address \'127.0.0.1\' has been dropped."',
+    'prefix'
+);
+$tester->expectLogTerminatingNotices();
+$tester->close();
+
+?>
+Done
+--EXPECT--
+exact: ok
+prefix: error
+Done
+--CLEAN--
+<?php
+require_once "tester.inc";
+FPM\Tester::clean();
+?>