{"record":{"id":"bc530a7bf17504f9","repo":"diegosouzapw/OmniRoute","slug":"remote-image-host-resolves-to-a-blocked-private-ad","errorCode":null,"errorMessage":"Remote image host resolves to a blocked private address (DNS rebinding)","messagePattern":"Remote image host resolves to a blocked private address \\(DNS rebinding\\)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/shared/network/remoteImageFetch.ts","lineNumber":90,"sourceCode":"): Promise<Array<{ address: string; family: number }>> {\n  if (guard !== \"public-only\") return [];\n  const hostname = url.hostname;\n  const bare =\n    hostname.startsWith(\"[\") && hostname.endsWith(\"]\") ? hostname.slice(1, -1) : hostname;\n  if (!bare) return [];\n  if (isIP(bare)) return [{ address: bare, family: isIP(bare) }];\n  let resolved: Array<{ address: string; family: number }>;\n  try {\n    resolved = await lookup(bare);\n  } catch {\n    throw new Error(\"Remote image host could not be resolved (blocked)\");\n  }\n  if (!resolved.length) {\n    throw new Error(\"Remote image host could not be resolved (blocked)\");\n  }\n  for (const { address } of resolved) {\n    if (isPrivateHost(address)) {\n      throw new Error(\"Remote image host resolves to a blocked private address (DNS rebinding)\");\n    }\n  }\n  return resolved;\n}\n/**\n * Build a `fetch` bound to a single already-DNS-validated address, ignoring\n * whatever the hostname resolves to at connect time. Exported for direct\n * testing: this is the mechanism that closes the DNS-rebinding TOCTOU gap\n * (GHSA-cmhj-wh2f-9cgx) — a second, real DNS lookup at connect time could\n * otherwise return a different (possibly private) address than the one\n * `assertHostnameResolvesPublic` validated.\n */\nexport function createPinnedFetch(address: string, family: number): typeof fetch {\n  const dispatcher = new Agent({\n    connect: {\n      // Node's `net.connect`/`tls.connect` invoke a custom `lookup` in one of\n      // two incompatible shapes depending on `options.all`: modern Node\n      // (autoSelectFamily / Happy Eyeballs, on by default since Node 18)","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/shared/network/remoteImageFetch.ts#L72-L108","documentation":"Error \"Remote image host resolves to a blocked private address (DNS rebinding)\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/shared/network/remoteImageFetch.ts:90 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}