vitest-dev/vitest · error · Error

import of '${fileUrl}' by undefined is not supported: http c

Error message

import of '${fileUrl}' by undefined is not supported: http can only be used to load local resources (use https instead).

What it means

Thrown by EsmExecutor.createNetworkModule when an `http:` import is attempted and the host is not a local loopback address (localhost, ::1, or an address in 127.0.0.0/8). For security, Vitest only permits http: imports that resolve to the local machine; remote http imports must use https. The 'by undefined' part reflects that the importer is not known at network-module creation time.

Source

Thrown at packages/vitest/src/runtime/vm/esm-executor.ts:125

    const cached = this.moduleCache.get(fileUrl)
    if (cached) {
      return cached
    }
    const m = this.loadWebAssemblyModule(getCode(), fileUrl)
    this.moduleCache.set(fileUrl, m)
    return m
  }

  public async createNetworkModule(fileUrl: string): Promise<VMModule> {
    // https://nodejs.org/api/esm.html#https-and-http-imports
    if (fileUrl.startsWith('http:')) {
      const url = new URL(fileUrl)
      if (
        url.hostname !== 'localhost'
        && url.hostname !== '::1'
        && (IPnumber(url.hostname) & IPmask(8)) !== this.#httpIp
      ) {
        throw new Error(
          // we don't know the importer, so it's undefined (the same happens in --pool=threads)
          `import of '${fileUrl}' by undefined is not supported: `
          + 'http can only be used to load local resources (use https instead).',
        )
      }
    }

    return this.createEsModule(fileUrl, () =>
      fetch(fileUrl).then(r => r.text()))
  }

  public async loadWebAssemblyModule(source: Buffer<ArrayBuffer>, identifier: string): Promise<VMModule> {
    const cached = this.moduleCache.get(identifier)
    if (cached) {
      return cached
    }

    const wasmModule = await WebAssembly.compile(source)

View on GitHub (pinned to d568f8ce37)

Solutions

1. Switch the import from `http://` to `https://` for remote resources.
2. If you genuinely need a local http server, ensure the URL host is `localhost` or `127.x.x.x`.
3. Avoid remote http imports in tests entirely; vendor the module locally and import it as a file.
4. Fetch the resource at runtime with global fetch instead of using an import specifier.

Example fix

// before
import data from 'http://example.com/data.json'

// after
import data from 'https://example.com/data.json'
// or vendored locally:
import data from './fixtures/data.json'

function assertSafeHttpImport(url: string) {
  const u = new URL(url)
  if (u.protocol === 'http:' && u.hostname !== 'localhost' && u.hostname !== '::1' && !u.hostname.startsWith('127.')) {
    throw new Error('Use https:// or a loopback http:// URL')
  }
}

When it happens

Trigger: A test file (or a module it imports) uses a bare `http://example.com/...` import specifier while running under Vitest's vm/threads pool with the ESM executor. The host resolves to a non-loopback IP, so the guard trips.

Common situations: Importing a remote module via http during tests. Copying example code that uses http data URLs. Misconfigured local server hostname that does not resolve to 127.0.0.0/8.

Related errors

• Expected IP address, received ${address}
• Invalid data URI
• Missing data URI encoding
• Invalid data URI encoding: ${encoding}
• Couldn't write file to fs

AI-assisted analysis of vitest-dev/vitest@d568f8ce37 (2026-08-03). Data as JSON: /data/errors/0b44918370147972.json. Report an issue: GitHub.