{"record":{"id":"18db44ceaf4e04a0","repo":"denoland/deno","slug":"err-out-of-range-18db44","errorCode":"ERR_OUT_OF_RANGE","errorMessage":"The value of \"candidate\" is out of range. It must be >= 0. Received ${candidate}","messagePattern":"The value of \"candidate\" is out of range\\. It must be >= 0\\. Received (.+?)","errorType":"exception","errorClass":"NodeRangeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/random.ts","lineNumber":94,"sourceCode":") {\n  if (typeof options === \"function\") {\n    callback = options;\n    options = {};\n  }\n\n  validateFunction(callback, \"callback\");\n  validateObject(options, \"options\");\n\n  const {\n    checks = 0,\n  } = options!;\n\n  validateInt32(checks, \"options.checks\", 0);\n\n  let candidateBytes: ArrayBufferView | ArrayBuffer;\n  if (typeof candidate === \"bigint\") {\n    if (candidate < 0) {\n      throw new ERR_OUT_OF_RANGE(\"candidate\", \">= 0\", candidate);\n    }\n    candidateBytes = bigintToBytes(candidate);\n  } else if (isAnyArrayBuffer(candidate) || isArrayBufferView(candidate)) {\n    const byteLength = isArrayBufferView(candidate)\n      ? arrayBufferViewByteLength(candidate as ArrayBufferView)\n      : ArrayBufferPrototypeGetByteLength(candidate as ArrayBuffer);\n    if (byteLength > OPENSSL_BIGNUM_MAX_BYTES) {\n      throw new NodeError(\n        \"ERR_OSSL_BN_BIGNUM_TOO_LONG\",\n        \"bignum too long\",\n      );\n    }\n    candidateBytes = candidate;\n  } else {\n    throw new ERR_INVALID_ARG_TYPE(\n      \"candidate\",\n      [\n        \"ArrayBuffer\",","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/random.ts#L76-L112","documentation":"Thrown by Deno's node:crypto polyfill for checkPrime() (ext/node/polyfills/internal/crypto/random.ts:94) when the candidate argument is a negative BigInt. checkPrime runs probabilistic primality tests and only makes sense for non-negative integers, so any candidate < 0n is rejected before the native op is invoked. The async checkPrime and its callback are never reached; the error is thrown synchronously.","triggerScenarios":"Calling crypto.checkPrime(-7n, cb) or crypto.checkPrime(-1n, { checks: 16 }, cb). Also hit when a computed BigInt (e.g. a subtraction or a value parsed from signed two's-complement bytes without masking) goes negative and is passed as candidate.","commonSituations":"Diffie-Hellman or prime-search code that derives candidates arithmetically; converting signed buffers to BigInt with BigInt.asIntN instead of BigInt.asUintN; unit tests feeding boundary values like -0n's neighbors.","solutions":["Ensure the candidate BigInt is non-negative before calling checkPrime (mask sign with BigInt.asUintN(bitLength, value) if the value came from signed bytes).","If the value legitimately can be negative, reject or absolute-value it in your own code first — primality of a negative number is not a meaningful query.","Pass the number as a Buffer/Uint8Array of unsigned bytes instead of a BigInt, since only the bigint branch checks sign."],"exampleFix":"// before\nconst p = maybeNegative;\ncrypto.checkPrime(p, (err, is) => {});\n\n// after\nconst p = BigInt.asUintN(2048, maybeNegative);\nif (p <= 0n) throw new RangeError('candidate must be positive');\ncrypto.checkPrime(p, (err, is) => {});","handlingStrategy":"validation","validationCode":"if (typeof candidate === 'bigint' && candidate < 0n) throw new RangeError('candidate must be >= 0');","typeGuard":"const isPrimeCandidate = (v) => (typeof v === 'bigint' ? v >= 0n : ArrayBuffer.isView(v) || v instanceof ArrayBuffer);","tryCatchPattern":"try { crypto.checkPrime(c, cb); } catch (e) { if (e.code === 'ERR_OUT_OF_RANGE') { /* normalize candidate and retry once */ } else throw e; }","preventionTips":["Keep candidates as unsigned BigInts; use BigInt.asUintN when reinterpreting bytes.","Start prime searches at 2n and only increment."],"tags":["node-compat","crypto","prime","bigint","argument-validation"],"backgroundTag":"argument-out-of-range","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}