gchq/CyberChef · error · OperationError

IPv6 CIDR must be less than 128

Error message

IPv6 CIDR must be less than 128

What it means

Thrown by ipv6CidrRange when the IPv6 prefix length is outside 0-127. Mirrors the IPv4 guard: /128 (single host) and out-of-range values are rejected. OperationError.

Source

Thrown at src/core/lib/IP.mjs:67

        }
    }
    return output;
}

/**
 * Parses an IPv6 CIDR range (e.g. ff00::/48) and displays information about it.
 *
 * @param {RegExp} cidr
 * @param {boolean} includeNetworkInfo
 * @returns {string}
 */
export function ipv6CidrRange(cidr, includeNetworkInfo) {
    let output = "";
    const network = strToIpv6(cidr[1]),
        cidrRange = parseInt(cidr[cidr.length-1], 10);

    if (cidrRange < 0 || cidrRange > 127) {
        throw new OperationError("IPv6 CIDR must be less than 128");
    }

    const ip1 = new Array(8),
        ip2 = new Array(8),
        total = new Array(128);

    const mask = genIpv6Mask(cidrRange);
    let totalDiff = "";


    for (let i = 0; i < 8; i++) {
        ip1[i] = network[i] & mask[i];
        ip2[i] = ip1[i] | (~mask[i] & 0x0000FFFF);
        totalDiff = (ip2[i] - ip1[i]).toString(2);

        if (totalDiff !== "0") {
            for (let n = 0; n < totalDiff.length; n++) {
                total[i*16 + 16-(totalDiff.length-n)] = totalDiff[n];

View on GitHub (pinned to 4290ea7539)

Solutions

1. Use an IPv6 prefix length of 0-127.
2. Treat /128 single-host addresses separately.
3. Validate the prefix is an integer in [0,127] before calling.

Example fix

// before
ipv6CidrRange(["ff00::/128", "ff00::", "128"], true);

// after
ipv6CidrRange(["ff00::/48", "ff00::", "48"], true);

function assertIpv6Cidr(prefix) {
  if (!Number.isInteger(prefix) || prefix < 0 || prefix > 127) {
    throw new Error(`IPv6 CIDR prefix must be 0-127, got ${prefix}`);
  }
}
const prefix = parseInt(match[match.length - 1], 10);
assertIpv6Cidr(prefix);
ipv6CidrRange(match, includeNetworkInfo);

const isRangeIpv6Cidr = prefix => Number.isInteger(prefix) && prefix >= 0 && prefix <= 127;

try {
  ipv6CidrRange(match, includeNetworkInfo);
} catch (err) {
  if (err instanceof OperationError && /IPv6 CIDR must be less than 128/.test(err.message)) {
    // /128 or out-of-range; handle as single host or correct input
  } else throw err;
}

When it happens

Trigger: Calling ipv6CidrRange with a prefix group of '128', a negative value, or non-numeric input that parseInt turns into NaN/out-of-range.

Common situations: User supplies a /128 host address expecting a one-address range; typo such as '/129'; missing prefix yields NaN.

Related errors

• IPv4 CIDR must be less than 32
• Block out of range.
• Badly formatted IPv6 address.
• ${this.name} must be greater than or equal to ${this.min}.
• ${this.name} must be less than or equal to ${this.max}.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/7503ab038bc7bcf6. Report an issue: GitHub.