{"record":{"id":"687da0af81a10dcb","repo":"facebook/react","slug":"581","errorCode":"581","errorMessage":"BigInt is too large. Received %s digits but the limit is %s.","messagePattern":"BigInt is too large\\. Received (.+?) digits but the limit is (.+?)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/react-server/src/ReactFlightReplyServer.js","lineNumber":1731,"sourceCode":"      }\n      case 'N': {\n        // $NaN\n        return NaN;\n      }\n      case 'u': {\n        // matches \"$undefined\"\n        // Special encoding for `undefined` which can't be serialized as JSON otherwise.\n        return undefined;\n      }\n      case 'D': {\n        // Date\n        return new Date(Date.parse(value.slice(2)));\n      }\n      case 'n': {\n        // BigInt\n        const bigIntStr = value.slice(2);\n        if (bigIntStr.length > MAX_BIGINT_DIGITS) {\n          throw new Error(\n            'BigInt is too large. Received ' +\n              bigIntStr.length +\n              ' digits but the limit is ' +\n              MAX_BIGINT_DIGITS +\n              '.',\n          );\n        }\n        if (arrayRoot !== null) {\n          bumpArrayCount(arrayRoot, bigIntStr.length, response);\n        }\n        return BigInt(bigIntStr);\n      }\n      case 'A':\n        return parseTypedArray(\n          response,\n          value,\n          ArrayBuffer,\n          1,","sourceCodeStart":1713,"sourceCodeEnd":1749,"githubUrl":"https://github.com/facebook/react/blob/eafeac097ba51e1eab809c07102126bd5f8e5425/packages/react-server/src/ReactFlightReplyServer.js#L1713-L1749","documentation":"React caps how many digits a serialized BigInt may carry when a client reply (server action arguments) is decoded, and rejects anything larger than MAX_BIGINT_DIGITS (300 in this tree). Parsing cost for BigInt grows with digit count, so unbounded numeric payloads are a denial-of-service vector against action endpoints. The message reports both the received digit count and the hard limit.","triggerScenarios":"Invoking a server action whose argument is a BigInt whose string form exceeds 300 digits, e.g. doThing(BigInt(hugeDigits)); serializing a big-number library output (bn.js, bigint-converted Decimal) into action arguments or client reply payloads.","commonSituations":"Passing token IDs, snowflake IDs, hashes, or crypto values as BigInt in action args; fuzz/test payloads with randomly generated huge numbers; converting decimal library results straight to BigInt before an action call.","solutions":["Send the value as a string and convert to BigInt inside the server action.","Validate and limit numeric input length on the client before invoking the action.","If giant integers are genuinely needed, encode them (hex/base64 string) and decode server-side."],"exampleFix":"// before\n<form action={updateBalance(BigInt(balanceDigits))}>\n\n// after — pass a string, parse on the server\n'use server';\nexport async function updateBalance(digits: string) {\n  if (digits.length > 300) throw new Error('balance too large');\n  const value = BigInt(digits);\n  // ...\n}","handlingStrategy":"validation","validationCode":"const MAX_BIGINT_DIGITS = 300; // match React's limit\nexport function assertSafeBigIntArgs(args: unknown[]) {\n  for (const a of args) {\n    if (typeof a === 'bigint' && a.toString().length > MAX_BIGINT_DIGITS) {\n      throw new Error('BigInt argument exceeds ' + MAX_BIGINT_DIGITS + ' digits');\n    }\n  }\n}","typeGuard":"export function isSerializableBigInt(v: unknown): v is bigint {\n  return typeof v !== 'bigint' || v.toString().length <= 300;\n}","tryCatchPattern":null,"preventionTips":["Never feed raw external numeric input straight into a BigInt action argument.","Cap numeric field length on the client before invoking server actions.","Prefer string transport for very large numbers."],"tags":["bigint","server-actions","serialization","input-limits"],"backgroundTag":"payload-size-limit-exceeded","analyzedSha":"eafeac097ba51e1eab809c07102126bd5f8e5425","analyzedAt":"2026-08-21T22:01:08.818Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}