{"record":{"id":"af44ea37382a9c48","repo":"facebook/react","slug":"571","errorCode":"571","errorMessage":"Maximum array nesting exceeded. Large nested arrays can be dangerous. Try adding intermediate objects.","messagePattern":"Maximum array nesting exceeded\\. Large nested arrays can be dangerous\\. Try adding intermediate objects\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/react-server/src/ReactFlightReplyServer.js","lineNumber":701,"sourceCode":"  return value;\n}\n\ntype NestedArrayContext = {\n  // Keeps track of how many slots, bytes or characters are in nested arrays/strings/typed arrays.\n  count: number,\n  // A single child is itself not harmful. There needs to be at least one parent array with more\n  // than one child.\n  fork: boolean,\n};\n\nfunction bumpArrayCount(\n  arrayContext: NestedArrayContext,\n  slots: number,\n  response: Response,\n): void {\n  const newCount = (arrayContext.count += slots);\n  if (newCount > response._arraySizeLimit && arrayContext.fork) {\n    throw new Error(\n      'Maximum array nesting exceeded. Large nested arrays can be dangerous. Try adding intermediate objects.',\n    );\n  }\n}\n\ntype InitializationReference = {\n  handler: InitializationHandler,\n  parentObject: Object,\n  key: string,\n  map: (\n    response: Response,\n    model: any,\n    parentObject: Object,\n    key: string,\n  ) => any,\n  path: Array<string>,\n  arrayRoot: null | NestedArrayContext,\n};","sourceCodeStart":683,"sourceCodeEnd":719,"githubUrl":"https://github.com/facebook/react/blob/eafeac097ba51e1eab809c07102126bd5f8e5425/packages/react-server/src/ReactFlightReplyServer.js#L683-L719","documentation":"When decoding a Flight reply (a server action invocation submitted from the client), React accumulates the total number of slots in nested arrays via bumpArrayCount. Once the count exceeds the response array size limit (default 1,000,000, configurable through createResponse's arraySizeLimit) inside a forked array (an array with siblings), it throws. This is a DoS guard against pathologically large nested arrays.","triggerScenarios":"A server action argument contains arrays whose cumulative element count exceeds the limit - deep trees, big matrices, full state snapshots. Large strings, BigInts, and typed arrays referenced inside the arrays also add their length/byteLength to the count. Only fires when the nested array has at least one parent array with more than one child (fork = true).","commonSituations":"Passing an entire client state tree to a server action; batch-edit forms that serialize every row; upgrading React to a version where the guard landed, so payloads that previously worked now throw; custom frameworks calling decodeReply on untrusted FormData with the default limit.","solutions":["Restructure the argument: wrap nesting levels in plain objects ({children: [...]}) or send a flattened list of ids/patches - the guard counts array slots, not object keys.","Send only deltas or ids and rehydrate the full structure on the server.","Split the work across multiple server action invocations.","If you control the runtime (custom RSC framework), pass a higher arraySizeLimit to createResponse after assessing your DoS exposure."],"exampleFix":"// before — client sends a deeply nested tree to a server action\nawait saveTree([[rows.map(r => [r.cells])]]); // millions of total array slots\n\n// after — flatten to records\nawait saveTree(rows.map(r => ({id: r.id, values: r.cells.flat()})));","handlingStrategy":"validation","validationCode":"const ARRAY_SLOT_LIMIT = 1_000_000;\nfunction estimateArraySlots(v: unknown): number {\n  if (Array.isArray(v)) {\n    let n = v.length;\n    for (const c of v) n += estimateArraySlots(c);\n    return n;\n  }\n  if (typeof v === 'string') return v.length;\n  if (typeof v === 'bigint') return String(v).length;\n  if (ArrayBuffer.isView(v)) return v.byteLength;\n  if (v && typeof v === 'object') {\n    let n = 0;\n    for (const k in v) n += estimateArraySlots((v as any)[k]);\n    return n;\n  }\n  return 0;\n}\n// run before invoking the action\nif (estimateArraySlots(args) > ARRAY_SLOT_LIMIT) {\n  throw new Error('Action payload too large; send ids/deltas instead');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Send ids, deltas, or patches to server actions instead of whole nested trees.","Wrap nested levels in plain objects; the limit counts array slots, not object keys.","Split very large batches across multiple action calls.","If you run a custom RSC runtime, size arraySizeLimit to your threat model in createResponse."],"tags":["react","server-actions","serialization","dos-protection","arrays"],"backgroundTag":"payload-size-limit-exceeded","analyzedSha":"eafeac097ba51e1eab809c07102126bd5f8e5425","analyzedAt":"2026-08-21T22:01:08.818Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}