{"record":{"id":"0a195351c26f0fc1","repo":"gchq/CyberChef","slug":"ipv4-cidr-must-be-less-than-32","errorCode":null,"errorMessage":"IPv4 CIDR must be less than 32","messagePattern":"IPv4 CIDR must be less than 32","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/IP.mjs","lineNumber":29,"sourceCode":"import Utils from \"../Utils.mjs\";\nimport OperationError from \"../errors/OperationError.mjs\";\n\n/**\n * Parses an IPv4 CIDR range (e.g. 192.168.0.0/24) and displays information about it.\n *\n * @param {RegExp} cidr\n * @param {boolean} includeNetworkInfo\n * @param {boolean} enumerateAddresses\n * @param {boolean} allowLargeList\n * @returns {string}\n */\nexport function ipv4CidrRange(cidr, includeNetworkInfo, enumerateAddresses, allowLargeList) {\n    const network = strToIpv4(cidr[1]),\n        cidrRange = parseInt(cidr[2], 10);\n    let output = \"\";\n\n    if (cidrRange < 0 || cidrRange > 31) {\n        throw new OperationError(\"IPv4 CIDR must be less than 32\");\n    }\n\n    const mask = ~(0xFFFFFFFF >>> cidrRange),\n        ip1 = network & mask,\n        ip2 = ip1 | ~mask;\n\n    if (includeNetworkInfo) {\n        output += \"Network: \" + ipv4ToStr(network) + \"\\n\";\n        output += \"CIDR: \" + cidrRange + \"\\n\";\n        output += \"Mask: \" + ipv4ToStr(mask) + \"\\n\";\n        output += \"Range: \" + ipv4ToStr(ip1) + \" - \" + ipv4ToStr(ip2) + \"\\n\";\n        output += \"Total addresses in range: \" + (((ip2 - ip1) >>> 0) + 1) + \"\\n\\n\";\n    }\n\n    if (enumerateAddresses) {\n        if (cidrRange >= 16 || allowLargeList) {\n            output += generateIpv4Range(ip1, ip2).join(\"\\n\");\n        } else {","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/IP.mjs#L11-L47","documentation":"Thrown by ipv4CidrRange when the CIDR prefix length is outside 0-31. The message says 'less than 32' but the guard (`cidrRange < 0 || cidrRange > 31`) also rejects /32 itself, because the mask computation `~(0xFFFFFFFF >>> 32)` is undefined for a 32-bit shift in JS (shifts are mod 32). OperationError, so it surfaces as recipe output.","triggerScenarios":"Calling ipv4CidrRange with a regex match whose prefix group is '32' (single host), negative, or non-numeric garbage parsed by parseInt into NaN/out-of-range.","commonSituations":"User enters a /32 host route expecting a single-address range; typo like '/33' or '/-1'; passing an IPv4 with no prefix so parseInt yields NaN.","solutions":["Use a prefix length of 0-31 for range operations.","For a /32 single host, handle it as a single address outside this function.","Validate the prefix is an integer in [0,31] before calling."],"exampleFix":"// before\nipv4CidrRange([\"10.0.0.0/32\", \"10.0.0.0\", \"32\"], true, false, false);\n\n// after\nipv4CidrRange([\"10.0.0.0/24\", \"10.0.0.0\", \"24\"], true, false, false);","handlingStrategy":"validation","validationCode":"function assertIpv4Cidr(prefix) {\n  if (!Number.isInteger(prefix) || prefix < 0 || prefix > 31) {\n    throw new Error(`IPv4 CIDR prefix must be 0-31, got ${prefix}`);\n  }\n}\nconst prefix = parseInt(match[2], 10);\nassertIpv4Cidr(prefix);\nipv4CidrRange(match, includeNetworkInfo, enumerateAddresses, allowLargeList);","typeGuard":"const isRangeIpv4Cidr = prefix => Number.isInteger(prefix) && prefix >= 0 && prefix <= 31;","tryCatchPattern":"try {\n  ipv4CidrRange(match, includeNetworkInfo, enumerateAddresses, allowLargeList);\n} catch (err) {\n  if (err instanceof OperationError && /IPv4 CIDR must be less than 32/.test(err.message)) {\n    // /32 or out-of-range; handle as single host or correct input\n  } else throw err;\n}","preventionTips":["Remember this function rejects /32 even though it is a legal CIDR.","Validate the prefix is an integer in [0,31] before calling.","Handle single-host /32 routes outside this function."],"tags":["ip","ipv4","cidr","validation","range"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}