{"record":{"id":"478f7e0d6a1f10b2","repo":"zloirock/core-js","slug":"unexpected-character-after-padding","errorCode":null,"errorMessage":"Unexpected character after padding","messagePattern":"Unexpected character after padding","errorType":"exception","errorClass":"SyntaxError","httpStatus":null,"severity":"error","filePath":"packages/core-js/internals/uint8-from-base64.js","lineNumber":132,"sourceCode":"    if (chr === '=') {\n      if (chunk.length < 2) {\n        throw new SyntaxError('Padding is too early');\n      }\n      index = skipAsciiWhitespace(string, index);\n      if (chunk.length === 2) {\n        if (index === stringLength) {\n          if (lastChunkHandling === 'stop-before-partial') {\n            break;\n          }\n          throw new SyntaxError('Malformed padding: only one =');\n        }\n        if (at(string, index) === '=') {\n          ++index;\n          index = skipAsciiWhitespace(string, index);\n        }\n      }\n      if (index < stringLength) {\n        throw new SyntaxError('Unexpected character after padding');\n      }\n      written = writeBytes(bytes, decodeBase64Chunk(chunk, alphabet, lastChunkHandling === 'strict'), written);\n      read = stringLength;\n      break;\n    }\n    if (!hasOwn(alphabet, chr)) {\n      throw new SyntaxError('Unexpected character');\n    }\n    var remainingBytes = maxLength - written;\n    if (remainingBytes === 1 && chunk.length === 2 || remainingBytes === 2 && chunk.length === 3) {\n      // special case: we can fit exactly the number of bytes currently represented by chunk, so we were just checking for `=`\n      break;\n    }\n\n    chunk += chr;\n    if (chunk.length === 4) {\n      written = writeBytes(bytes, decodeBase64Chunk(chunk, alphabet, false), written);\n      chunk = '';","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/zloirock/core-js/blob/84e45fba098dd3a177d5cf2247d06ab8e98d3790/packages/core-js/internals/uint8-from-base64.js#L114-L150","documentation":"After a complete padded chunk, the base64 spec allows no further data: once padding '=' has been consumed and remaining ASCII whitespace skipped, any non-whitespace character remaining in the string means there is data after the final padding, which is invalid. fromBase64 throws this SyntaxError rather than silently ignoring the trailing content.","triggerScenarios":"Uint8Array.fromBase64('AB==C') or any string where a '==' (or 'X=' two-byte chunk) terminated chunk is followed by more non-whitespace characters, with lastChunkHandling 'strict' or 'loose'.","commonSituations":"Concatenating two base64 strings where the first already ended with padding, embedding base64 inside a larger payload without delimiters, or appending suffixes (e.g. newlines mixed with stray characters, checksums) to encoded values.","solutions":["Remove all characters after the final '=' in the string before decoding.","If multiple values are being concatenated, decode each separately instead of joining the base64 strings.","Trim the string and confirm it ends with padding only when it is genuinely the final chunk.","Catch SyntaxError and reject the input at your API boundary with a clear message."],"exampleFix":"// before\nUint8Array.fromBase64('QUJDRA==extra'); // Unexpected character after padding\n// after\nconst idx = raw.indexOf('==');\nconst clean = idx !== -1 ? raw.slice(0, idx + 2) : raw;\nUint8Array.fromBase64(clean);","handlingStrategy":"validation","validationCode":"function hasNoTrailingData(s) {\n  const idx = s.indexOf('=');\n  if (idx === -1) return true;\n  return /^[\\t\\n\\f\\r ]*$/.test(s.slice(idx + 1)); // only whitespace may follow first '='\n}","typeGuard":"function isBareBase64(s) {\n  return typeof s === 'string' && /^[A-Za-z0-9+/=_\\-\\s]*$/.test(s);\n}","tryCatchPattern":"try {\n  const bytes = Uint8Array.fromBase64(input);\n} catch (e) {\n  if (e instanceof SyntaxError && e.message.includes('after padding')) {\n    throw new TypeError('Base64 input has data after final padding — decode values separately');\n  }\n  throw e;\n}","preventionTips":["Strip any data-URI prefix and trailing metadata before decoding.","Never concatenate base64 strings; decode each part individually.","Trim and validate the string ends exactly at padding.","Enforce a strict regex (^[A-Za-z0-9+/]*={0,2}$) at the input boundary."],"tags":["base64","syntax-error","padding","trailing-data"],"backgroundTag":"malformed-base64-padding","analyzedSha":"84e45fba098dd3a177d5cf2247d06ab8e98d3790","analyzedAt":"2026-08-30T20:36:10.323Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}