{"record":{"id":"52d04ad775bbc731","repo":"sveltejs/kit","slug":"could-not-deserialize-binary-form-invalid-file-me","errorCode":null,"errorMessage":"Could not deserialize binary form: invalid file metadata","messagePattern":"Could not deserialize binary form: invalid file metadata","errorType":"exception","errorClass":"SvelteKitError","httpStatus":400,"severity":"error","filePath":"packages/kit/src/runtime/form-utils.js","lineNumber":296,"sourceCode":"\t\t\tthrow deserialize_error('invalid file offset table');\n\t\t}\n\n\t\tfile_offsets = /** @type {Array<number>} */ (parsed_offsets);\n\t\tfiles_start_offset = HEADER_BYTES + data_length + file_offsets_length;\n\t}\n\n\t/** @type {Array<{ offset: number, size: number }>} */\n\tconst file_spans = [];\n\tconst [data, meta] = devalue.parse(text_decoder.decode(data_buffer), {\n\t\tFile: ([name, type, size, last_modified, index]) => {\n\t\t\tif (\n\t\t\t\ttypeof name !== 'string' ||\n\t\t\t\ttypeof type !== 'string' ||\n\t\t\t\ttypeof size !== 'number' ||\n\t\t\t\ttypeof last_modified !== 'number' ||\n\t\t\t\ttypeof index !== 'number'\n\t\t\t) {\n\t\t\t\tthrow deserialize_error('invalid file metadata');\n\t\t\t}\n\n\t\t\tlet offset = file_offsets[index];\n\n\t\t\t// Check that the file offset table entry has not been already\n\t\t\t// used. If not, immediately mark it as used.\n\t\t\tif (offset === undefined) {\n\t\t\t\tthrow deserialize_error('duplicate file offset table index');\n\t\t\t}\n\t\t\tfile_offsets[index] = undefined;\n\n\t\t\toffset += files_start_offset;\n\n\t\t\tfile_spans.push({ offset, size });\n\n\t\t\treturn new Proxy(new LazyFile(name, type, size, last_modified, get_chunk, offset), {\n\t\t\t\tgetPrototypeOf() {\n\t\t\t\t\t// Trick validators into thinking this is a normal File","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/form-utils.js#L278-L314","documentation":"Each file entry in the binary form payload's metadata must have string name, string type, numeric size, numeric last_modified, and numeric index. deserialize_binary_form throws this when any field is missing or of the wrong type. It prevents malformed metadata from being turned into File objects or used to index the offset table.","triggerScenarios":"A SvelteKit action request whose per-file metadata record (read from the JSON payload section) is missing fields or has wrong types — caused by truncated/corrupted payload, a mismatched serializer version, or a hand-crafted request.","commonSituations":"Older clients talking to newer servers (or vice versa) after the binary format changed; request bodies edited by middleware; attackers probing the endpoint with malformed metadata.","solutions":["Align @sveltejs/kit versions across client bundle and server runtime.","Let SvelteKit produce the request (native form POST or use:enhance) instead of custom serialization.","Check for middleware or proxies that alter the JSON section of the body.","If you see it from unknown clients, treat it as malformed traffic and reject at the edge."],"exampleFix":"// before: tampered/custom metadata\nmeta.files = [{ name: 'a.txt', size: '10' }];\n// after: only pass through kit-serialized payloads unmodified\nconst payload = await request.formData(); // handled by kit internals","handlingStrategy":"validation","validationCode":"function validFileMeta(f) {\n  return f && typeof f.name === 'string' && typeof f.type === 'string' &&\n    typeof f.size === 'number' && typeof f.last_modified === 'number' && typeof f.index === 'number';\n}","typeGuard":"function isFileMetadata(v) {\n  return typeof v === 'object' && v !== null &&\n    typeof v.name === 'string' && typeof v.type === 'string' &&\n    typeof v.size === 'number' && typeof v.last_modified === 'number' && typeof v.index === 'number';\n}","tryCatchPattern":"try {\n  await deserialize_binary_form(request);\n} catch (e) {\n  if (String(e.message).includes('invalid file metadata')) {\n    return new Response('Malformed file metadata', { status: 400 });\n  }\n  throw e;\n}","preventionTips":["Keep client and server kit versions in sync.","Avoid middleware that rewrites the JSON section of action request bodies.","Only deserialize payloads produced by kit's own serializer."],"tags":["sveltekit","forms","serialization","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}