{"record":{"id":"ad06551b9b57e0a3","repo":"danny-avila/LibreChat","slug":"avatar-response-too-large-buffer-length-bytes","errorCode":null,"errorMessage":"Avatar response too large: ${buffer.length} bytes","messagePattern":"Avatar response too large: (.+?) bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"api/server/services/Files/images/avatar.js","lineNumber":70,"sourceCode":"  });\n\n  if (!response.ok) {\n    throw new Error(`Failed to fetch image from URL. Status: ${response.status}`);\n  }\n\n  const contentLength = parseInt(response.headers.get('content-length') ?? '0', 10);\n  if (contentLength > MAX_AVATAR_BYTES) {\n    throw new Error(`Avatar response too large: ${contentLength} bytes`);\n  }\n\n  /**\n   * Re-check after read in case the server lied about Content-Length or\n   * omitted it. `node-fetch` v2 honors the `size` option above and throws on\n   * overflow, but Defense-in-depth: assert on the actual buffer length.\n   */\n  const buffer = await response.buffer();\n  if (buffer.length > MAX_AVATAR_BYTES) {\n    throw new Error(`Avatar response too large: ${buffer.length} bytes`);\n  }\n  return buffer;\n}\n\n/**\n * Uploads an avatar image for a user. This function can handle various types of input (URL, Buffer, or File object),\n * processes the image to a square format, converts it to target format, and returns the resized buffer.\n *\n * @param {Object} params - The parameters object.\n * @param {string} params.userId - The unique identifier of the user for whom the avatar is being uploaded.\n * @param {string} options.desiredFormat - The desired output format of the image.\n * @param {(string|Buffer|File)} params.input - The input representing the avatar image. Can be a URL (string),\n *                                               a Buffer, or a File object.\n * @param {{ headers?: Record<string, string> }} [params.fetchOptions] - Optional headers for trusted avatar URLs.\n *\n * @returns {Promise<any>}\n *          A promise that resolves to a resized buffer.\n *","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/danny-avila/LibreChat/blob/5ff282f9006c436e561de1afd39a481bea1ef0d8/api/server/services/Files/images/avatar.js#L52-L88","documentation":"Defense-in-depth post-read guard: after `response.buffer()` completes, asserts the actual buffer length is within MAX_AVATAR_BYTES (10 MB). This catches origins that lied about Content-Length (or omitted it) and served more bytes than declared. node-fetch's `size` option already aborts oversized reads, but this assert turns the resulting state into an explicit, loggable error.","triggerScenarios":"Server returns `Content-Length: 1024` but streams 50 MB; server omits Content-Length and streams until the connection closes with a payload over 10 MB; chunked transfer-encoding delivering an oversized body.","commonSituations":"Malicious origins attempting slow-loris-style memory exhaustion via header/body mismatch; misconfigured streaming backends that buffer-then-flush without accurate headers; compromised or buggy image CDNs.","solutions":["Treat as a sign the origin is untrustworthy — do not retry the same URL, surface the failure.","Mirror a known-good avatar from a trusted source instead of the failing URL.","If recurring for one provider, file a bug with the provider about Content-Length accuracy.","Confirm the size cap (10 MB) is appropriate; do not raise it to mask a hostile origin."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await fetchAvatarBuffer(url); }\ncatch (e) {\n  if (/Avatar response too large/.test(e.message) && e.message.includes('buffer.length')) {\n    logger.warn('Avatar origin lied about Content-Length', { url });\n    return res.status(413).json({ error: 'Avatar source is untrustworthy or too large.' });\n  }\n  throw e;\n}","preventionTips":["Treat this guard firing as a sign of a hostile or broken origin — don't retry blindly.","Mirror avatars from trusted providers to your own storage to avoid repeated exposure.","Log the URL when this fires to spot malicious patterns."],"tags":["avatar","size-limit","defense-in-depth","security"],"backgroundTag":null,"analyzedSha":"5ff282f9006c436e561de1afd39a481bea1ef0d8","analyzedAt":"2026-08-12T21:38:08.145Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}