diegosouzapw/OmniRoute · error · Error

Remote image host resolves to a blocked private address (DNS

Error message

Remote image host resolves to a blocked private address (DNS rebinding)

What it means

Error "Remote image host resolves to a blocked private address (DNS rebinding)" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/shared/network/remoteImageFetch.ts:90

): Promise<Array<{ address: string; family: number }>> {
  if (guard !== "public-only") return [];
  const hostname = url.hostname;
  const bare =
    hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
  if (!bare) return [];
  if (isIP(bare)) return [{ address: bare, family: isIP(bare) }];
  let resolved: Array<{ address: string; family: number }>;
  try {
    resolved = await lookup(bare);
  } catch {
    throw new Error("Remote image host could not be resolved (blocked)");
  }
  if (!resolved.length) {
    throw new Error("Remote image host could not be resolved (blocked)");
  }
  for (const { address } of resolved) {
    if (isPrivateHost(address)) {
      throw new Error("Remote image host resolves to a blocked private address (DNS rebinding)");
    }
  }
  return resolved;
}
/**
 * Build a `fetch` bound to a single already-DNS-validated address, ignoring
 * whatever the hostname resolves to at connect time. Exported for direct
 * testing: this is the mechanism that closes the DNS-rebinding TOCTOU gap
 * (GHSA-cmhj-wh2f-9cgx) — a second, real DNS lookup at connect time could
 * otherwise return a different (possibly private) address than the one
 * `assertHostnameResolvesPublic` validated.
 */
export function createPinnedFetch(address: string, family: number): typeof fetch {
  const dispatcher = new Agent({
    connect: {
      // Node's `net.connect`/`tls.connect` invoke a custom `lookup` in one of
      // two incompatible shapes depending on `options.all`: modern Node
      // (autoSelectFamily / Happy Eyeballs, on by default since Node 18)

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/shared/network/remoteImageFetch.ts:90 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/bc530a7bf17504f9. Report an issue: GitHub.