{"record":{"id":"1d7ef80611bc9b36","repo":"oven-sh/bun","slug":"proxy-path-length-exceeded","errorCode":"PROXY_PATH_LENGTH_EXCEEDED","errorMessage":"PROXY_PATH_LENGTH_EXCEEDED","messagePattern":"PROXY_PATH_LENGTH_EXCEEDED","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":197,"sourceCode":"    #[error(\"SUBJECT_ISSUER_MISMATCH\")]\n    SUBJECT_ISSUER_MISMATCH,\n    #[error(\"AKID_SKID_MISMATCH\")]\n    AKID_SKID_MISMATCH,\n    #[error(\"AKID_ISSUER_SERIAL_MISMATCH\")]\n    AKID_ISSUER_SERIAL_MISMATCH,\n    #[error(\"KEYUSAGE_NO_CERTSIGN\")]\n    KEYUSAGE_NO_CERTSIGN,\n    #[error(\"UNABLE_TO_GET_CRL_ISSUER\")]\n    UNABLE_TO_GET_CRL_ISSUER,\n    #[error(\"UNHANDLED_CRITICAL_EXTENSION\")]\n    UNHANDLED_CRITICAL_EXTENSION,\n    #[error(\"KEYUSAGE_NO_CRL_SIGN\")]\n    KEYUSAGE_NO_CRL_SIGN,\n    #[error(\"UNHANDLED_CRITICAL_CRL_EXTENSION\")]\n    UNHANDLED_CRITICAL_CRL_EXTENSION,\n    #[error(\"INVALID_NON_CA\")]\n    INVALID_NON_CA,\n    #[error(\"PROXY_PATH_LENGTH_EXCEEDED\")]\n    PROXY_PATH_LENGTH_EXCEEDED,\n    #[error(\"KEYUSAGE_NO_DIGITAL_SIGNATURE\")]\n    KEYUSAGE_NO_DIGITAL_SIGNATURE,\n    #[error(\"PROXY_CERTIFICATES_NOT_ALLOWED\")]\n    PROXY_CERTIFICATES_NOT_ALLOWED,\n    #[error(\"INVALID_EXTENSION\")]\n    INVALID_EXTENSION,\n    #[error(\"INVALID_POLICY_EXTENSION\")]\n    INVALID_POLICY_EXTENSION,\n    #[error(\"NO_EXPLICIT_POLICY\")]\n    NO_EXPLICIT_POLICY,\n    #[error(\"DIFFERENT_CRL_SCOPE\")]\n    DIFFERENT_CRL_SCOPE,\n    #[error(\"UNSUPPORTED_EXTENSION_FEATURE\")]\n    UNSUPPORTED_EXTENSION_FEATURE,\n    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L179-L215","documentation":"CertError::PROXY_PATH_LENGTH_EXCEEDED maps BoringSSL X509 verify code 38 (X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED) via get_cert_error_from_no() in src/http/lib.rs:1557. An RFC 3820 proxy certificate chain violates a proxy path length constraint embedded in a proxy cert of the chain. JS error.code is PROXY_PATH_LENGTH_EXCEEDED with message 'proxy path length constraint exceeded' (FetchTasklet.rs:1449).","triggerScenarios":"TLS handshake where the presented chain contains RFC 3820 proxy certificates and the number of subsequent proxy certs exceeds the ppathlen constraint declared by one of them (delegated-credential/proxy-style setups, grid-computing X.509 proxies stacked too deep).","commonSituations":"Grid/academic X.509 proxy deployments (VOMS proxies with limited delegation), experimental delegation setups, proxies generated with ppathlen:0 then further delegated.","solutions":["Flatten the delegation: use a single-level proxy certificate rather than chained proxies","Regenerate the proxy with a sufficient proxy path length (e.g., myproxy-init -p or grid-proxy-init with matching limits)","Avoid routing fetch() traffic through endpoints that require stacked proxy certs; use a plain TLS chain","Identify the constraint: openssl x509 -in proxy.pem -noout -text | grep -i -A2 'proxy'"],"exampleFix":"# before: proxy2 -> proxy1(ppathlen:0) -> ee  (rejected)\n# after: single-level proxy\ngrid-proxy-init -hours 12   # or:\nopenssl x509 -req -in proxy.csr -signkey user-key.pem \\\n  -extfile <(printf 'proxyCertInfo=critical,language:1.3.6.1.5.5.7.21.1,pathlen:1') \\\n  -out proxy.pem -days 1","handlingStrategy":"try-catch","validationCode":"import { X509Certificate } from \"node:crypto\";\nconst cert = new X509Certificate(await Bun.file(\"proxy.pem\").text());\nconst text = await Bun.$`openssl x509 -in proxy.pem -noout -text`.text();\nconst ppathlen = text.match(/Path Length:(\\d+)/)?.[1];\nif (ppathlen !== undefined && Number(ppathlen) < 1) {\n  throw new Error(\"proxy pathlen forbids further delegation\");\n}","typeGuard":"function isProxyPathLenExceeded(e: unknown): e is Error & { code: \"PROXY_PATH_LENGTH_EXCEEDED\" } {\n  return e instanceof Error && (e as any).code === \"PROXY_PATH_LENGTH_EXCEEDED\";\n}","tryCatchPattern":"try { await fetch(url); } catch (e) { if (isProxyPathLenExceeded(e)) { reissueFlatProxy(new URL(url).host); throw e; } throw e; }","preventionTips":["Limit X.509 proxy delegation to a single level","Set proxy pathlen explicitly when generating proxies","Prefer tokens/API keys over stacked proxy certificates for delegation"],"tags":["tls","certificate","proxy-cert","rfc3820","pki"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}