{"record":{"id":"4716387d145391c7","repo":"abhigyanpatwari/GitNexus","slug":"registry-response-too-large","errorCode":null,"errorMessage":"Registry response too large","messagePattern":"Registry response too large","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gitnexus/src/core/update-check.ts","lineNumber":146,"sourceCode":"    const entry = await readCache(registry.identity);\n    if (\n      (!entry || !isUpdateCacheFresh(entry.lastCheckAt, now)) &&\n      options.refreshIfStale !== false\n    ) {\n      void refresh(options).catch(() => {});\n    }\n    if (!entry) return null;\n    return stateFrom(entry, installedVersionOf(options));\n  } catch {\n    return null;\n  }\n}\n\nasync function readResponseBody(response: Response): Promise<string> {\n  const advertised = Number(response.headers.get('content-length'));\n  if (Number.isFinite(advertised) && advertised > MAX_RESPONSE_BYTES) {\n    await response.body?.cancel().catch(() => {});\n    throw new Error('Registry response too large');\n  }\n  if (!response.body) return '';\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let bytes = 0;\n  try {\n    for (;;) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      bytes += value.byteLength;\n      if (bytes > MAX_RESPONSE_BYTES) throw new Error('Registry response too large');\n      chunks.push(value);\n    }\n  } finally {\n    if (bytes > MAX_RESPONSE_BYTES) await reader.cancel().catch(() => {});\n    reader.releaseLock();\n  }","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/0d1aed942f0e8b5d3bac27519fff441aceea722d/gitnexus/src/core/update-check.ts#L128-L164","documentation":"readResponseBody in update-check.ts enforces a size ceiling (MAX_RESPONSE_BYTES) on registry responses. If the Content-Length header advertises a body larger than the cap, the body is cancelled immediately and this error is thrown, protecting the update checker from absurdly large or hostile responses.","triggerScenarios":"Fetching the version endpoint from a registry whose 200 response carries a Content-Length exceeding MAX_RESPONSE_BYTES — e.g. a misconfigured proxy returning a huge page, or a non-registry server responding to the URL.","commonSituations":"A corporate proxy intercepting the registry request and returning a large HTML block page; pointing the update registry at a full package-document endpoint (which for some registries is many MB) instead of a small version endpoint; an attacker-controlled mirror.","solutions":["Point the update registry URL at the small version/dist-tags endpoint, not the full packument","Check for an intercepting proxy or SSL-inspection appliance returning bloated responses; bypass it for the registry host","If your registry legitimately serves a large manifest, run/patch with a larger MAX_RESPONSE_BYTES — only after verifying the source is trusted"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const head = await fetch(registryUrl, {method:'HEAD'}); const len = Number(head.headers.get('content-length')); if (Number.isFinite(len) && len > MAX_RESPONSE_BYTES) skipUpdateCheck();","typeGuard":null,"tryCatchPattern":"try { const latest = await fetchLatest(url, 0); } catch (e) { if (e.message === 'Registry response too large') { console.warn('Update check skipped: oversized registry response'); } else throw e; }","preventionTips":["Point update checks at lightweight version endpoints, not full packuments","Ensure proxies don't inject large block pages on the registry host","Verify response sizes with curl before configuring a custom registry"],"tags":["npm","registry","network","limits"],"backgroundTag":"payload-too-large","analyzedSha":"0d1aed942f0e8b5d3bac27519fff441aceea722d","analyzedAt":"2026-09-08T00:40:44.970Z","contentChangedAt":"2026-09-08T00:40:44.970Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}