{"id":"8967609dce535c73","repo":"vitest-dev/vitest","slug":"expected-ip-address-received-address","errorCode":null,"errorMessage":"Expected IP address, received ${address}","messagePattern":"Expected IP address, received (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/vitest/src/runtime/vm/esm-executor.ts","lineNumber":261,"sourceCode":"          this.setExport('default', obj)\n        },\n        { context: this.context, identifier },\n      )\n      this.moduleCache.set(identifier, module)\n      return module\n    }\n\n    return this.createEsModule(identifier, () => code)\n  }\n}\n\nfunction IPnumber(address: string) {\n  const ip = address.match(/^(\\d+)\\.(\\d+)\\.(\\d+)\\.(\\d+)$/)\n  if (ip) {\n    return (+ip[1] << 24) + (+ip[2] << 16) + (+ip[3] << 8) + +ip[4]\n  }\n\n  throw new Error(`Expected IP address, received ${address}`)\n}\n\nfunction IPmask(maskSize: number) {\n  return -1 << (32 - maskSize)\n}\n","sourceCodeStart":243,"sourceCodeEnd":267,"githubUrl":"https://github.com/vitest-dev/vitest/blob/d568f8ce3739b532d5bf2c1ee1e45e8a8a473d09/packages/vitest/src/runtime/vm/esm-executor.ts#L243-L267","documentation":"Thrown by the IPnumber helper when its input does not match an IPv4 dotted-quad pattern (`^\\d+\\.\\d+\\.\\d+\\.\\d+$`). IPnumber is used by createNetworkModule to check whether an http: import host is loopback (127.0.0.0/8). If the hostname passed in is a DNS name, an IPv6 literal, or malformed, the regex fails and this error is raised instead of an IP being computed.","triggerScenarios":"An `http://` import whose hostname is not a raw IPv4 address (e.g. a hostname like `myhost`, an IPv6 like `::1` handled elsewhere, or `localhost` handled by the earlier hostname check). The createNetworkModule guard calls IPnumber(url.hostname); if hostname slipped through the localhost/::1 checks and is not dotted-quad, IPnumber throws.","commonSituations":"Importing over http from a machine name that is not 'localhost' and not an IPv4 literal (e.g. a LAN hostname). The earlier guard already covers 'localhost' and '::1', so this fires for other non-IPv4 hostnames.","solutions":["Use https:// instead of http:// for any non-loopback host.","Use the IPv4 loopback address explicitly, e.g. `http://127.0.0.1:port/...`.","Use `localhost` as the hostname (handled before IPnumber is called).","Avoid network module imports in tests; fetch data at runtime or vendor fixtures locally."],"exampleFix":"// before\nimport data from 'http://myhost:3000/data.json'\n\n// after\nimport data from 'https://myhost:3000/data.json'\n// or, for a local server:\nimport data from 'http://127.0.0.1:3000/data.json'","handlingStrategy":"validation","validationCode":"function isLoopbackHttp(url: string): boolean {\n  const u = new URL(url)\n  if (u.protocol !== 'http:') return true\n  if (u.hostname === 'localhost' || u.hostname === '::1') return true\n  return /^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(u.hostname) && u.hostname.startsWith('127.')\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use https:// for non-loopback hosts.","Use 127.0.0.1 or localhost for local http servers.","Avoid http: imports from hostnames that are not IPv4 literals."],"tags":["network","security","esm","vm"],"analyzedSha":"d568f8ce3739b532d5bf2c1ee1e45e8a8a473d09","analyzedAt":"2026-08-03T20:23:56.861Z","schemaVersion":2}