{"record":{"id":"c57ee0bdda6898dd","repo":"paperclipai/paperclip","slug":"all-resolved-ips-for-originalhostname-are-in-pr","errorCode":null,"errorMessage":"All resolved IPs for ${originalHostname} are in private/reserved ranges","messagePattern":"All resolved IPs for (.+?) are in private/reserved ranges","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/services/plugin-host-services.ts","lineNumber":201,"sourceCode":"  const timeoutPromise = new Promise<never>((_, reject) => {\n    setTimeout(\n      () => reject(new Error(`DNS lookup timed out after ${DNS_LOOKUP_TIMEOUT_MS}ms for ${originalHostname}`)),\n      DNS_LOOKUP_TIMEOUT_MS,\n    );\n  });\n\n  try {\n    const results = await Promise.race([dnsPromise, timeoutPromise]);\n    if (results.length === 0) {\n      throw new Error(`DNS resolution returned no results for ${originalHostname}`);\n    }\n\n    // Filter to only non-private IPs instead of rejecting the entire request\n    // when some IPs are private. This handles multi-homed hosts that resolve\n    // to both private and public addresses.\n    const safeResults = results.filter((entry) => !isPrivateIP(entry.address));\n    if (safeResults.length === 0) {\n      throw new Error(\n        `All resolved IPs for ${originalHostname} are in private/reserved ranges`,\n      );\n    }\n\n    const resolved = safeResults[0]!;\n    return {\n      parsedUrl: parsed,\n      resolvedAddress: resolved.address,\n      hostHeader,\n      tlsServername: parsed.protocol === \"https:\" && isIP(originalHostname) === 0\n        ? originalHostname\n        : undefined,\n      useTls: parsed.protocol === \"https:\",\n    };\n  } catch (err) {\n    // Re-throw our own errors; wrap DNS failures\n    if (err instanceof Error && (\n      err.message.startsWith(\"All resolved IPs\") ||","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/server/src/services/plugin-host-services.ts#L183-L219","documentation":"DNS resolved the plugin fetch hostname, but every returned IP is in a private or reserved range. The SSRF filter found no public address to use, so the outbound request is refused to protect internal networks.","triggerScenarios":"Thrown at server/src/services/plugin-host-services.ts:201 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a publicly routable hostname; requests to private/reserved IP ranges are blocked (SSRF protection)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}