{"record":{"id":"34b29e0ccdeffe71","repo":"netbirdio/netbird","slug":"invalid-port-number-must-be-between-1-and-65535","errorCode":null,"errorMessage":"invalid port number: must be between 1 and 65535","messagePattern":"invalid port number: must be between 1 and 65535","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/cmd/expose.go","lineNumber":107,"sourceCode":"\t}\n\treturn strconv.FormatUint(uint64(fallback), 10)\n}\n\n// resolveExternalPort returns the effective external port, defaulting to the target port.\nfunc resolveExternalPort(targetPort uint64) uint16 {\n\tif exposeExternalPort != 0 {\n\t\treturn exposeExternalPort\n\t}\n\treturn uint16(targetPort)\n}\n\nfunc validateExposeFlags(cmd *cobra.Command, portStr string) (uint64, error) {\n\tport, err := strconv.ParseUint(portStr, 10, 32)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"invalid port number: %s\", portStr)\n\t}\n\tif port == 0 || port > 65535 {\n\t\treturn 0, fmt.Errorf(\"invalid port number: must be between 1 and 65535\")\n\t}\n\n\tif !isProtocolValid(exposeProtocol) {\n\t\treturn 0, fmt.Errorf(\"unsupported protocol %q: must be http, https, tcp, udp, or tls\", exposeProtocol)\n\t}\n\n\tif isClusterProtocol(exposeProtocol) {\n\t\tif exposePin != \"\" || exposePassword != \"\" || len(exposeUserGroups) > 0 {\n\t\t\treturn 0, fmt.Errorf(\"auth flags (--with-pin, --with-password, --with-user-groups) are not supported for %s protocol\", exposeProtocol)\n\t\t}\n\t} else if cmd.Flags().Changed(\"with-external-port\") {\n\t\treturn 0, fmt.Errorf(\"--with-external-port is not supported for %s protocol\", exposeProtocol)\n\t}\n\n\tif exposePin != \"\" && !pinRegexp.MatchString(exposePin) {\n\t\treturn 0, fmt.Errorf(\"invalid pin: must be exactly 6 digits\")\n\t}\n","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/expose.go#L89-L125","documentation":"The port argument parsed as a number but is out of range: ParseUint succeeded and the value equals 0 or exceeds 65535. Rejected entirely client-side in validateExposeFlags.","triggerScenarios":"`netbird expose 0`, `netbird expose 65536`, `netbird expose 70000`, or any port-like number above the TCP/UDP limit.","commonSituations":"Off-by-one at the 65536 boundary; wrong port copied from documentation or notes; placeholder values like 99999 left in scripts.","solutions":["Choose a port in 1-65535 that the local service actually listens on","Discover the real port with `ss -ltnp` (Linux), `netstat -an | grep LISTEN`, or `lsof -i` and use that"],"exampleFix":"# before\nnetbird expose 65536\n\n# after\nnetbird expose 8080","handlingStrategy":"validation","validationCode":"port, err := strconv.ParseUint(portArg, 10, 32)\nif err != nil || port < 1 || port > 65535 {\n\tlog.Fatalf(\"port must be in 1..65535, got %q\", portArg)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Clamp user-supplied ports to 1-65535 before building the command","Verify the service's actual listening port with ss/netstat instead of guessing","Watch the 65536 off-by-one when incrementing a configured port"],"tags":["cli","validation","port","range-check","netbird-cli"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}