diff --git a/packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts b/packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
index fa119dea89c86..17475b01776a4 100644
--- a/packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
+++ b/packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
@@ -275,7 +275,7 @@ export class PrefixList extends PrefixListBase {
       const entries = props.entries;
       // Regular expressions for validating IPv6 addresses
       if (props?.addressFamily === AddressFamily.IP_V6) {
-        const ipv6Regex = /^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?$/i;
+        const ipv6Regex = /^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?$/i;
         for (const entry of entries) {
           if (!ipv6Regex.test(entry.cidr)) {
             throw new ValidationError(lit`InvalidPvAddressRange`, `Invalid IPv6 address range: ${entry.cidr}`, this);
diff --git a/packages/aws-cdk-lib/aws-ec2/test/prefix-list.test.ts b/packages/aws-cdk-lib/aws-ec2/test/prefix-list.test.ts
index 496708736f5ab..c9a6e5d9aabde 100644
--- a/packages/aws-cdk-lib/aws-ec2/test/prefix-list.test.ts
+++ b/packages/aws-cdk-lib/aws-ec2/test/prefix-list.test.ts
@@ -158,6 +158,40 @@ describe('prefix list', () => {
     }).toThrow('Invalid IPv6 address range: 10.0.0.1/32');
   });
 
+  test('ipv6 prefixlist accepts entries with an embedded IPv4 address', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    new PrefixList(stack, 'prefix-list', {
+      addressFamily: AddressFamily.IP_V6,
+      entries: [
+        { cidr: '::ffff:192.168.0.1/128' },
+        { cidr: '64:ff9b::192.0.2.33/96', description: 'nat64' },
+      ],
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::EC2::PrefixList', {
+      AddressFamily: 'IPv6',
+      Entries: [
+        { Cidr: '::ffff:192.168.0.1/128' },
+        { Cidr: '64:ff9b::192.0.2.33/96', Description: 'nat64' },
+      ],
+    });
+  });
+
+  test('ipv6 prefixlist rejects a malformed embedded IPv4 address', () => {
+    // GIVEN
+    const stack = new Stack();
+    expect(() => {
+      new PrefixList(stack, 'prefix-list', {
+        addressFamily: AddressFamily.IP_V6,
+        entries: [
+          { cidr: '::ffff:1dd.1dd.1dd.1dd/128' },
+        ],
+      });
+    }).toThrow('Invalid IPv6 address range: ::ffff:1dd.1dd.1dd.1dd/128');
+  });
+
   test('fromLookup returns a correct PrefixList', () => {
     // GIVEN
     const resultObjs = [