gchq/CyberChef · error · OperationError

CIDR must be less than 32 for IPv4 or 128 for IPv6

Error message

CIDR must be less than 32 for IPv4 or 128 for IPv6

What it means

Thrown by the Group IP addresses operation when the user-supplied CIDR subnet value is outside the supported range. The guard rejects cidr < 0 or cidr > 127 before any IP parsing happens, because the IPv4 mask is only computed correctly for cidr < 32 and the IPv6 mask helper genIpv6Mask assumes an at-most-128-bit address. Note the message is slightly inaccurate: it says 'less than 32 for IPv4 or 128 for IPv6', but the code actually forbids 128 entirely (only 0..127 pass).

Source

Thrown at src/core/operations/GroupIPAddresses.mjs:71

     */
    run(input, args) {
        const delim = Utils.charRep(args[0]),
            cidr = args[1],
            onlySubnets = args[2],
            ipv4Mask = cidr < 32 ? ~(0xFFFFFFFF >>> cidr) : 0xFFFFFFFF,
            ipv6Mask = genIpv6Mask(cidr),
            ips = input.split(delim),
            ipv4Networks = {},
            ipv6Networks = {};
        let match = null,
            output = "",
            ip = null,
            network = null,
            networkStr = "",
            i;

        if (cidr < 0 || cidr > 127) {
            throw new OperationError("CIDR must be less than 32 for IPv4 or 128 for IPv6");
        }

        // Parse all IPs and add to network dictionary
        for (i = 0; i < ips.length; i++) {
            if ((match = IPV4_REGEX.exec(ips[i]))) {
                ip = strToIpv4(match[1]) >>> 0;
                network = ip & ipv4Mask;

                if (network in ipv4Networks) {
                    ipv4Networks[network].push(ip);
                } else {
                    ipv4Networks[network] = [ip];
                }
            } else if ((match = IPV6_REGEX.exec(ips[i]))) {
                ip = strToIpv6(match[1]);
                network = [];
                networkStr = "";

View on GitHub (pinned to 4290ea7539)

Solutions

1. Set the CIDR argument to an integer in 0..31 for IPv4-only grouping.
2. Set the CIDR argument to an integer in 0..127 for IPv6 grouping (128 is rejected even though valid in RFC terms).
3. If you genuinely need /128 single-host grouping for IPv6, this operation cannot do it - pre-group the input yourself or request an operation enhancement.

Example fix

// before
const args = ["\n", 128, false];
groupIP.run("2001:db8::1", args);
// after
const args = ["\n", 127, false];
groupIP.run("2001:db8::1", args);

function assertCidr(cidr) {
  if (!Number.isInteger(cidr) || cidr < 0 || cidr > 127) {
    throw new RangeError(`CIDR must be an integer in 0..127, got ${cidr}`);
  }
  // for IPv4 grouping also keep it under 32
  if (onlyIpv4Input && cidr > 31) {
    throw new RangeError(`CIDR for IPv4 grouping should be 0..31, got ${cidr}`);
  }
}

function isValidCidr(cidr) {
  return Number.isInteger(cidr) && cidr >= 0 && cidr <= 127;
}

try {
  result = groupIP.run(input, [delim, cidr, onlySubnets]);
} catch (e) {
  if (e instanceof OperationError && /CIDR/.test(e.message)) {
    // clamp and retry, or surface to the user
    cidr = Math.min(127, Math.max(0, cidr));
    result = groupIP.run(input, [delim, cidr, onlySubnets]);
  } else throw e;
}

When it happens

Trigger: Setting the 'Subnet (CIDR)' argument to a negative number, 128, or any value above 127 in the Group IP addresses recipe. Also triggered programmatically by passing args[1] outside [0,127].

Common situations: User typing 128 expecting to represent a single IPv6 host; copy-pasting a /128 from an address; entering a CIDR meant for a different tool that allows the full 0..128 range; off-by-one confusion from the misleading message text.

Related errors

• IPv4 CIDR must be less than 32
• IPv6 CIDR must be less than 128
• Unrecognised input format.
• More than 4 blocks.
• Block out of range.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/65888d2bc5d91921. Report an issue: GitHub.