{"record":{"id":"92ade4871ae48319","repo":"projectdiscovery/nuclei","slug":"file-q-exceeds-max-read-size-of-d-bytes","errorCode":null,"errorMessage":"file %q exceeds max read size of %d bytes","messagePattern":"file %q exceeds max read size of (.+?) bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/smbsession/session.go","lineNumber":241,"sourceCode":"\t}\n\tif err := ops.UseShare(share); err != nil {\n\t\treturn \"\", fmt.Errorf(\"mount share %q: %w\", share, err)\n\t}\n\t// Prefer streaming Open+LimitReader when the backend supports it (tests /\n\t// future goimpacket Open). Fall back to Cat for the stock client.\n\tif opener, ok := ops.(shareOpener); ok {\n\t\tf, err := opener.Open(normalized)\n\t\tif err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\t\tdefer func() { _ = f.Close() }()\n\t\tlimited := io.LimitReader(f, maxBytes+1)\n\t\tbody, err := io.ReadAll(limited)\n\t\tif err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\t\tif int64(len(body)) > maxBytes {\n\t\t\treturn \"\", fmt.Errorf(\"file %q exceeds max read size of %d bytes\", normalized, maxBytes)\n\t\t}\n\t\treturn string(body), nil\n\t}\n\tbody, err := ops.Cat(normalized)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tif int64(len(body)) > maxBytes {\n\t\treturn \"\", fmt.Errorf(\"file %q exceeds max read size of %d bytes\", normalized, maxBytes)\n\t}\n\treturn body, nil\n}\n\nfunc listTree(ops shareBackend, share, root string, maxDepth, maxEntries int) ([]Entry, error) {\n\tif err := RequireShareName(share); err != nil {\n\t\treturn nil, err\n\t}\n\tif maxDepth <= 0 {","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/smbsession/session.go#L223-L259","documentation":"Thrown on the streaming path of readFile when the file is larger than the read cap. The library opens the file and wraps it in io.LimitReader(f, maxBytes+1); reading maxBytes+1 bytes proves the file exceeds the limit, and the error reports the offending path and the cap. maxBytes defaults to DefaultMaxReadBytes (10 MiB) when the caller passes 0 or a negative value.","triggerScenarios":"Reading a file larger than 10 MiB with the default cap; passing an explicit maxBytes smaller than the target file; scanning hosts with large log/binary files at well-known paths.","commonSituations":"Templates reading log files, memory dumps, or installers that blow past the default; memory-protection limit kicking in when the author intended a full read.","solutions":["Pass an explicit larger maxBytes as the third ReadFile argument when bigger files are expected","Read only the needed prefix (e.g. first 64 KiB of a config file) instead of raising the cap broadly","Skip oversized files on error and continue the scan"],"exampleFix":"// before\nconst data = client.ReadFile('C$', '/inetpub/logs/log.txt', 0); // default 10 MiB cap\n\n// after\nconst data = client.ReadFile('C$', '/inetpub/logs/log.txt', 50 * 1024 * 1024);","handlingStrategy":"try-catch","validationCode":"// pass an explicit cap matching your expectation before the call\nconst MAX = 20 * 1024 * 1024;\nclient.ReadFile('C$', '/big/log.txt', MAX);","typeGuard":null,"tryCatchPattern":"try { return client.ReadFile(share, path, cap); } catch (e) { if (String(e).includes('exceeds max read size')) { return null; /* skip oversized file */ } throw e; }","preventionTips":["Always pass an explicit maxBytes sized to intent","Read only prefixes of large files","Treat oversize errors as skip conditions in scan logic"],"tags":["smb","javascript","nuclei","resource-limits"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}