{"record":{"id":"0b44918370147972","repo":"vitest-dev/vitest","slug":"import-of-fileurl-by-undefined-is-not-support","errorCode":null,"errorMessage":"import of '${fileUrl}' by undefined is not supported: http can only be used to load local resources (use https instead).","messagePattern":"import of '(.+?)' by undefined is not supported: http can only be used to load local resources \\(use https instead\\)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/vitest/src/runtime/vm/esm-executor.ts","lineNumber":381,"sourceCode":"    const cached = this.moduleCache.get(fileUrl)\n    if (cached) {\n      return cached\n    }\n    const m = this.loadWebAssemblyModule(getCode(), fileUrl)\n    this.moduleCache.set(fileUrl, m)\n    return m\n  }\n\n  public async createNetworkModule(fileUrl: string): Promise<VMModule> {\n    // https://nodejs.org/api/esm.html#https-and-http-imports\n    if (fileUrl.startsWith('http:')) {\n      const url = new URL(fileUrl)\n      if (\n        url.hostname !== 'localhost'\n        && url.hostname !== '::1'\n        && (IPnumber(url.hostname) & IPmask(8)) !== this.#httpIp\n      ) {\n        throw new Error(\n          // we don't know the importer, so it's undefined (the same happens in --pool=threads)\n          `import of '${fileUrl}' by undefined is not supported: `\n          + 'http can only be used to load local resources (use https instead).',\n        )\n      }\n    }\n\n    return this.createEsModule(fileUrl, () =>\n      fetch(fileUrl).then(r => r.text()))\n  }\n\n  public async loadWebAssemblyModule(source: Buffer<ArrayBuffer>, identifier: string): Promise<VMModule> {\n    const cached = this.moduleCache.get(identifier)\n    if (cached) {\n      return cached\n    }\n\n    const wasmModule = await WebAssembly.compile(source)","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/vitest-dev/vitest/blob/1fa9837ec26533512fdcad8baebf249771bd340a/packages/vitest/src/runtime/vm/esm-executor.ts#L363-L399","documentation":"In the vm pool, createNetworkModule() refuses to fetch modules over plain http unless the host is local. It allows only hostname 'localhost', '::1', or any address in the 127.0.0.0/8 loopback block (#httpIp = IPnumber('127.0.0.0') masked with /8). Any other http host is rejected and the importer is reported as 'undefined' because the executor has no importer context.","triggerScenarios":"A test or module does a dynamic import of an http:// URL whose hostname is a literal IPv4 outside 127.0.0.0/8 (e.g. http://10.0.0.1/mod.js or http://192.168.1.5/x.js) while running in the vm pool. Localhost and 127.x.x.x are allowed; everything else is blocked.","commonSituations":"Pointing a test at a dev server on a LAN IP, a Docker bridge address, or a service mesh sidecar over http. Also happens when an http URL is hardcoded in a config or fixture and the dev machine resolves to a non-loopback address.","solutions":["Serve the resource over https instead (http is rejected for non-local hosts by design).","Make the host loopback: use http://localhost/... or http://127.x.x.x/... so it passes the 127.0.0.0/8 check.","Use a pool other than vm (threads/forks) if you genuinely need http imports from a non-local host, since this gate is vm-pool specific.","Vendor the module locally and import it via a file:// URL."],"exampleFix":"// before\nawait import('http://10.0.0.5/api/mock.js')\n\n// after\nawait import('http://localhost/api/mock.js')\n// or\nawait import('https://10.0.0.5/api/mock.js')","handlingStrategy":"validation","validationCode":"import { isLoopback } from 'node:net'\nfunction allowedHttp(url) {\n  if (!url.startsWith('http://')) return true\n  const h = new URL(url).hostname\n  return h === 'localhost' || h === '::1' || /^127\\./.test(h)\n}\nif (!allowedHttp(specifier)) throw new Error('use https or localhost')","typeGuard":"function isLocalHttp(u) {\n  if (!u.protocol.startsWith('http:')) return true\n  return ['localhost','::1'].includes(u.hostname) || /^127\\./.test(u.hostname)\n}","tryCatchPattern":null,"preventionTips":["Prefer https:// for any remote module import in tests.","Bind dev servers used by tests to localhost/127.0.0.1.","Use a non-vm pool if you must import over http from a non-loopback host."],"tags":["network","http","vm","security","loopback"],"backgroundTag":null,"analyzedSha":"1fa9837ec26533512fdcad8baebf249771bd340a","analyzedAt":"2026-08-11T16:11:39.638Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}