cloudflare/cloudflared · error

error parsing invalid network from backend

Error message

error parsing invalid network from backend

What it means

Payload validation in cfapi CIDR.UnmarshalJSON: the backend sent a string for the CIDR field, but net.ParseCIDR cannot parse it (or ParseCIDR yielded a nil network). The route data from Tunnelstore is not a valid network prefix, so the response cannot be decoded into DetailedRoute.

Source

Thrown at cfapi/ip_route.go:57

func (c CIDR) MarshalJSON() ([]byte, error) {
	str := c.String()
	json, err := json.Marshal(str)
	if err != nil {
		return nil, errors.Wrap(err, "error serializing CIDR into JSON")
	}
	return json, nil
}

// UnmarshalJSON parses a JSON string into net.IPNet
func (c *CIDR) UnmarshalJSON(data []byte) error {
	var s string
	if err := json.Unmarshal(data, &s); err != nil {
		return errors.Wrap(err, "error parsing cidr string")
	}
	_, network, err := net.ParseCIDR(s)
	if err != nil {
		return errors.Wrap(err, "error parsing invalid network from backend")
	}
	if network == nil {
		return fmt.Errorf("backend returned invalid network %s", s)
	}
	*c = CIDR(*network)
	return nil
}

// NewRoute has all the parameters necessary to add a new route to the table.
type NewRoute struct {
	Network  net.IPNet
	TunnelID uuid.UUID
	Comment  string
	// Optional field. If unset, backend will assume the default vnet for the account.
	VNetID *uuid.UUID
}

// MarshalJSON handles fields with non-JSON types (e.g. net.IPNet).

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Capture the offending string from the API response and check it is a valid CIDR (e.g. 1.2.3.0/24).
2. Confirm no proxy/middlebox is mutating the response.
3. Retry; persistent invalid backend data should be reported to Cloudflare.

When it happens

Trigger: Thrown at cfapi/ip_route.go:57 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/c268155886b324a4. Report an issue: GitHub.