vitest-dev/vitest · error · Error

Expected IP address, received ${address}

Error message

Expected IP address, received ${address}

What it means

Thrown by the IPnumber helper when its input does not match an IPv4 dotted-quad pattern (`^\d+\.\d+\.\d+\.\d+$`). IPnumber is used by createNetworkModule to check whether an http: import host is loopback (127.0.0.0/8). If the hostname passed in is a DNS name, an IPv6 literal, or malformed, the regex fails and this error is raised instead of an IP being computed.

Source

Thrown at packages/vitest/src/runtime/vm/esm-executor.ts:261

          this.setExport('default', obj)
        },
        { context: this.context, identifier },
      )
      this.moduleCache.set(identifier, module)
      return module
    }

    return this.createEsModule(identifier, () => code)
  }
}

function IPnumber(address: string) {
  const ip = address.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/)
  if (ip) {
    return (+ip[1] << 24) + (+ip[2] << 16) + (+ip[3] << 8) + +ip[4]
  }

  throw new Error(`Expected IP address, received ${address}`)
}

function IPmask(maskSize: number) {
  return -1 << (32 - maskSize)
}

View on GitHub (pinned to d568f8ce37)

Solutions

  1. Use https:// instead of http:// for any non-loopback host.
  2. Use the IPv4 loopback address explicitly, e.g. `http://127.0.0.1:port/...`.
  3. Use `localhost` as the hostname (handled before IPnumber is called).
  4. Avoid network module imports in tests; fetch data at runtime or vendor fixtures locally.

Example fix

// before
import data from 'http://myhost:3000/data.json'

// after
import data from 'https://myhost:3000/data.json'
// or, for a local server:
import data from 'http://127.0.0.1:3000/data.json'
Defensive patterns

Strategy: validation

Validate before calling

function isLoopbackHttp(url: string): boolean {
  const u = new URL(url)
  if (u.protocol !== 'http:') return true
  if (u.hostname === 'localhost' || u.hostname === '::1') return true
  return /^\d+\.\d+\.\d+\.\d+$/.test(u.hostname) && u.hostname.startsWith('127.')
}

Prevention

When it happens

Trigger: An `http://` import whose hostname is not a raw IPv4 address (e.g. a hostname like `myhost`, an IPv6 like `::1` handled elsewhere, or `localhost` handled by the earlier hostname check). The createNetworkModule guard calls IPnumber(url.hostname); if hostname slipped through the localhost/::1 checks and is not dotted-quad, IPnumber throws.

Common situations: Importing over http from a machine name that is not 'localhost' and not an IPv4 literal (e.g. a LAN hostname). The earlier guard already covers 'localhost' and '::1', so this fires for other non-IPv4 hostnames.

Related errors


AI-assisted analysis of vitest-dev/vitest@d568f8ce37 (2026-08-03). Data as JSON: /data/errors/8967609dce535c73.json. Report an issue: GitHub.