{"record":{"id":"3fee86bd1275868c","repo":"oven-sh/bun","slug":"path-length-exceeded","errorCode":"PATH_LENGTH_EXCEEDED","errorMessage":"PATH_LENGTH_EXCEEDED","messagePattern":"PATH_LENGTH_EXCEEDED","errorType":"error_code","errorClass":"CertError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":171,"sourceCode":"    #[error(\"ERROR_IN_CRL_NEXT_UPDATE_FIELD\")]\n    ERROR_IN_CRL_NEXT_UPDATE_FIELD,\n    #[error(\"OUT_OF_MEM\")]\n    OUT_OF_MEM,\n    #[error(\"DEPTH_ZERO_SELF_SIGNED_CERT\")]\n    DEPTH_ZERO_SELF_SIGNED_CERT,\n    #[error(\"SELF_SIGNED_CERT_IN_CHAIN\")]\n    SELF_SIGNED_CERT_IN_CHAIN,\n    #[error(\"UNABLE_TO_GET_ISSUER_CERT_LOCALLY\")]\n    UNABLE_TO_GET_ISSUER_CERT_LOCALLY,\n    #[error(\"UNABLE_TO_VERIFY_LEAF_SIGNATURE\")]\n    UNABLE_TO_VERIFY_LEAF_SIGNATURE,\n    #[error(\"CERT_CHAIN_TOO_LONG\")]\n    CERT_CHAIN_TOO_LONG,\n    #[error(\"CERT_REVOKED\")]\n    CERT_REVOKED,\n    #[error(\"INVALID_CA\")]\n    INVALID_CA,\n    #[error(\"PATH_LENGTH_EXCEEDED\")]\n    PATH_LENGTH_EXCEEDED,\n    #[error(\"INVALID_PURPOSE\")]\n    INVALID_PURPOSE,\n    #[error(\"CERT_UNTRUSTED\")]\n    CERT_UNTRUSTED,\n    #[error(\"CERT_REJECTED\")]\n    CERT_REJECTED,\n    #[error(\"SUBJECT_ISSUER_MISMATCH\")]\n    SUBJECT_ISSUER_MISMATCH,\n    #[error(\"AKID_SKID_MISMATCH\")]\n    AKID_SKID_MISMATCH,\n    #[error(\"AKID_ISSUER_SERIAL_MISMATCH\")]\n    AKID_ISSUER_SERIAL_MISMATCH,\n    #[error(\"KEYUSAGE_NO_CERTSIGN\")]\n    KEYUSAGE_NO_CERTSIGN,\n    #[error(\"UNABLE_TO_GET_CRL_ISSUER\")]\n    UNABLE_TO_GET_CRL_ISSUER,\n    #[error(\"UNHANDLED_CRITICAL_EXTENSION\")]","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L153-L189","documentation":"CertError::PATH_LENGTH_EXCEEDED maps BoringSSL X509 verify code 25 (X509_V_ERR_PATH_LENGTH_EXCEEDED) via get_cert_error_from_no() in src/http/lib.rs:1544. An intermediate's Basic Constraints pathlen (path length constraint) is smaller than the number of CA certificates that follow it in the chain, so path building fails. JS error.code is PATH_LENGTH_EXCEEDED with message 'path length constraint exceeded' (FetchTasklet.rs:1446).","triggerScenarios":"Chain contains an intermediate with pathlen:0 (or 1) followed by additional intermediate CA(s); e.g., leaf <- sub-CA-A(pathlen:0) <- sub-CA-B <- root, where A cannot have another CA below it.","commonSituations":"Internal PKI teams delegate an 'issuing CA' with pathlen:0 and then later create sub-CAs beneath it; wrong intermediate from a cross-signed hierarchy served in the chain; CA templates with overly restrictive pathlen.","solutions":["Inspect pathlen of every served intermediate: openssl x509 -in int.pem -text -noout | grep -A1 'Path Len'","Serve the chain that avoids the constrained intermediate (pick the alternate path that satisfies pathlen)","Ask the CA to reissue the intermediate with a sufficient pathlen (or pathlen absent)","Restructure the PKI so leafs are issued directly from the pathlen-limited CA"],"exampleFix":"# before: chain root -> intA(pathlen:0) -> intB -> leaf  (rejected)\n# after: reissue leaf directly under intA\nopenssl x509 -req -in leaf.csr -CA intA.pem -CAkey intA-key.pem \\\n  -extfile <(printf 'basicConstraints=CA:FALSE\nkeyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth') \\\n  -out leaf.pem -days 390","handlingStrategy":"try-catch","validationCode":"import { X509Certificate } from \"node:crypto\";\nconst int = new X509Certificate(await Bun.file(\"intermediate.pem\").text());\n// X509Certificate exposes ca but not pathlen; parse it for ops checks:\nimport { execSync } from \"node:child_process\";\nconst pathlen = execSync(\"openssl x509 -in intermediate.pem -noout -text\").toString().match(/pathlen:(\\d+)/)?.[1];\nif (pathlen !== undefined && Number(pathlen) < 1 && process.env.REQUIRES_SUB_CA === \"1\") {\n  throw new Error(\"intermediate pathlen forbids sub-CAs — pick another chain\");\n}","typeGuard":"function isPathLengthExceeded(e: unknown): e is Error & { code: \"PATH_LENGTH_EXCEEDED\" } {\n  return e instanceof Error && (e as any).code === \"PATH_LENGTH_EXCEEDED\";\n}","tryCatchPattern":"try { await fetch(url); } catch (e) { if (isPathLengthExceeded(e)) { alertPkiTeam(\"pathlen violated on chain for \" + new URL(url).host); return useDirectLeafChain(url); } throw e; }","preventionTips":["Document each issuing CA's pathlen in your PKI inventory","Validate new chains with openssl verify -show_chain before rollout","Avoid stacking sub-CAs beneath pathlen:0 issuers"],"tags":["tls","certificate","pki","chain","fetch"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}