{"record":{"id":"65888d2bc5d91921","repo":"gchq/CyberChef","slug":"cidr-must-be-less-than-32-for-ipv4-or-128-for-ipv6","errorCode":null,"errorMessage":"CIDR must be less than 32 for IPv4 or 128 for IPv6","messagePattern":"CIDR must be less than 32 for IPv4 or 128 for IPv6","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/GroupIPAddresses.mjs","lineNumber":71,"sourceCode":"     */\n    run(input, args) {\n        const delim = Utils.charRep(args[0]),\n            cidr = args[1],\n            onlySubnets = args[2],\n            ipv4Mask = cidr < 32 ? ~(0xFFFFFFFF >>> cidr) : 0xFFFFFFFF,\n            ipv6Mask = genIpv6Mask(cidr),\n            ips = input.split(delim),\n            ipv4Networks = {},\n            ipv6Networks = {};\n        let match = null,\n            output = \"\",\n            ip = null,\n            network = null,\n            networkStr = \"\",\n            i;\n\n        if (cidr < 0 || cidr > 127) {\n            throw new OperationError(\"CIDR must be less than 32 for IPv4 or 128 for IPv6\");\n        }\n\n        // Parse all IPs and add to network dictionary\n        for (i = 0; i < ips.length; i++) {\n            if ((match = IPV4_REGEX.exec(ips[i]))) {\n                ip = strToIpv4(match[1]) >>> 0;\n                network = ip & ipv4Mask;\n\n                if (network in ipv4Networks) {\n                    ipv4Networks[network].push(ip);\n                } else {\n                    ipv4Networks[network] = [ip];\n                }\n            } else if ((match = IPV6_REGEX.exec(ips[i]))) {\n                ip = strToIpv6(match[1]);\n                network = [];\n                networkStr = \"\";\n","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/GroupIPAddresses.mjs#L53-L89","documentation":"Thrown by the Group IP addresses operation when the user-supplied CIDR subnet value is outside the supported range. The guard rejects cidr < 0 or cidr > 127 before any IP parsing happens, because the IPv4 mask is only computed correctly for cidr < 32 and the IPv6 mask helper genIpv6Mask assumes an at-most-128-bit address. Note the message is slightly inaccurate: it says 'less than 32 for IPv4 or 128 for IPv6', but the code actually forbids 128 entirely (only 0..127 pass).","triggerScenarios":"Setting the 'Subnet (CIDR)' argument to a negative number, 128, or any value above 127 in the Group IP addresses recipe. Also triggered programmatically by passing args[1] outside [0,127].","commonSituations":"User typing 128 expecting to represent a single IPv6 host; copy-pasting a /128 from an address; entering a CIDR meant for a different tool that allows the full 0..128 range; off-by-one confusion from the misleading message text.","solutions":["Set the CIDR argument to an integer in 0..31 for IPv4-only grouping.","Set the CIDR argument to an integer in 0..127 for IPv6 grouping (128 is rejected even though valid in RFC terms).","If you genuinely need /128 single-host grouping for IPv6, this operation cannot do it - pre-group the input yourself or request an operation enhancement."],"exampleFix":"// before\nconst args = [\"\\n\", 128, false];\ngroupIP.run(\"2001:db8::1\", args);\n// after\nconst args = [\"\\n\", 127, false];\ngroupIP.run(\"2001:db8::1\", args);","handlingStrategy":"validation","validationCode":"function assertCidr(cidr) {\n  if (!Number.isInteger(cidr) || cidr < 0 || cidr > 127) {\n    throw new RangeError(`CIDR must be an integer in 0..127, got ${cidr}`);\n  }\n  // for IPv4 grouping also keep it under 32\n  if (onlyIpv4Input && cidr > 31) {\n    throw new RangeError(`CIDR for IPv4 grouping should be 0..31, got ${cidr}`);\n  }\n}","typeGuard":"function isValidCidr(cidr) {\n  return Number.isInteger(cidr) && cidr >= 0 && cidr <= 127;\n}","tryCatchPattern":"try {\n  result = groupIP.run(input, [delim, cidr, onlySubnets]);\n} catch (e) {\n  if (e instanceof OperationError && /CIDR/.test(e.message)) {\n    // clamp and retry, or surface to the user\n    cidr = Math.min(127, Math.max(0, cidr));\n    result = groupIP.run(input, [delim, cidr, onlySubnets]);\n  } else throw e;\n}","preventionTips":["Constrain the CIDR input UI to 0..127 (or 0..31 if only IPv4 is expected).","Validate cidr as an integer before passing it as args[1].","Remember 128 is rejected even though it is RFC-valid for IPv6 single-host."],"tags":["ipv4","ipv6","subnet","cidr","argument-validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}