abhigyanpatwari/GitNexus · error

Registry response too large

Error message

Registry response too large

What it means

readResponseBody in update-check.ts enforces a size ceiling (MAX_RESPONSE_BYTES) on registry responses. If the Content-Length header advertises a body larger than the cap, the body is cancelled immediately and this error is thrown, protecting the update checker from absurdly large or hostile responses.

Source

Thrown at gitnexus/src/core/update-check.ts:146

    const entry = await readCache(registry.identity);
    if (
      (!entry || !isUpdateCacheFresh(entry.lastCheckAt, now)) &&
      options.refreshIfStale !== false
    ) {
      void refresh(options).catch(() => {});
    }
    if (!entry) return null;
    return stateFrom(entry, installedVersionOf(options));
  } catch {
    return null;
  }
}

async function readResponseBody(response: Response): Promise<string> {
  const advertised = Number(response.headers.get('content-length'));
  if (Number.isFinite(advertised) && advertised > MAX_RESPONSE_BYTES) {
    await response.body?.cancel().catch(() => {});
    throw new Error('Registry response too large');
  }
  if (!response.body) return '';

  const reader = response.body.getReader();
  const chunks: Uint8Array[] = [];
  let bytes = 0;
  try {
    for (;;) {
      const { done, value } = await reader.read();
      if (done) break;
      bytes += value.byteLength;
      if (bytes > MAX_RESPONSE_BYTES) throw new Error('Registry response too large');
      chunks.push(value);
    }
  } finally {
    if (bytes > MAX_RESPONSE_BYTES) await reader.cancel().catch(() => {});
    reader.releaseLock();
  }

View on GitHub (pinned to 0d1aed942f)

Solutions

1. Point the update registry URL at the small version/dist-tags endpoint, not the full packument
2. Check for an intercepting proxy or SSL-inspection appliance returning bloated responses; bypass it for the registry host
3. If your registry legitimately serves a large manifest, run/patch with a larger MAX_RESPONSE_BYTES — only after verifying the source is trusted

const head = await fetch(registryUrl, {method:'HEAD'}); const len = Number(head.headers.get('content-length')); if (Number.isFinite(len) && len > MAX_RESPONSE_BYTES) skipUpdateCheck();

try { const latest = await fetchLatest(url, 0); } catch (e) { if (e.message === 'Registry response too large') { console.warn('Update check skipped: oversized registry response'); } else throw e; }

When it happens

Trigger: Fetching the version endpoint from a registry whose 200 response carries a Content-Length exceeding MAX_RESPONSE_BYTES — e.g. a misconfigured proxy returning a huge page, or a non-registry server responding to the URL.

Common situations: A corporate proxy intercepting the registry request and returning a large HTML block page; pointing the update registry at a full package-document endpoint (which for some registries is many MB) instead of a small version endpoint; an attacker-controlled mirror.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• Too many registry redirects
• Registry returned ${response.status}
• Unsupported npm registry protocol
• Registry URL cannot contain query or fragment
• Registry redirect missing location

AI-assisted analysis of abhigyanpatwari/GitNexus@0d1aed942f (2026-09-08). Data as JSON: /api/errors/4716387d145391c7. Report an issue: GitHub.