{"record":{"id":"e0be95996badd378","repo":"evanw/esbuild","slug":"unicode-escape-sequence-is-out-of-range","errorCode":null,"errorMessage":"Unicode escape sequence is out of range","messagePattern":"Unicode escape sequence is out of range","errorType":"panic","errorClass":"LexerPanic","httpStatus":null,"severity":"error","filePath":"internal/js_lexer/js_lexer.go","lineNumber":2365,"sourceCode":"\t\t\t\t\t\t\tif isFirst {\n\t\t\t\t\t\t\t\treturn nil, false, start + i - width3\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tbreak variableLength\n\t\t\t\t\t\tdefault:\n\t\t\t\t\t\t\treturn nil, false, start + i - width3\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif value > utf8.MaxRune {\n\t\t\t\t\t\t\tisOutOfRange = true\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tisFirst = false\n\t\t\t\t\t}\n\n\t\t\t\t\tif isOutOfRange && reportErrors {\n\t\t\t\t\t\tlexer.addRangeError(logger.Range{Loc: logger.Loc{Start: int32(start + hexStart)}, Len: int32(i - hexStart)},\n\t\t\t\t\t\t\t\"Unicode escape sequence is out of range\")\n\t\t\t\t\t\tpanic(LexerPanic{})\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\t// Fixed-length\n\t\t\t\t\tfor j := 0; j < 4; j++ {\n\t\t\t\t\t\tswitch c3 {\n\t\t\t\t\t\tcase '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':\n\t\t\t\t\t\t\tvalue = value*16 | (c3 - '0')\n\t\t\t\t\t\tcase 'a', 'b', 'c', 'd', 'e', 'f':\n\t\t\t\t\t\t\tvalue = value*16 | (c3 + 10 - 'a')\n\t\t\t\t\t\tcase 'A', 'B', 'C', 'D', 'E', 'F':\n\t\t\t\t\t\t\tvalue = value*16 | (c3 + 10 - 'A')\n\t\t\t\t\t\tdefault:\n\t\t\t\t\t\t\treturn nil, false, start + i - width3\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif j < 3 {\n\t\t\t\t\t\t\tc3, width3 = utf8.DecodeRuneInString(text[i:])\n\t\t\t\t\t\t\ti += width3","sourceCodeStart":2347,"sourceCodeEnd":2383,"githubUrl":"https://github.com/evanw/esbuild/blob/f6058f8364fe7ab91ca57a83e02577ed74c9cae4/internal/js_lexer/js_lexer.go#L2347-L2383","documentation":"While decoding a variable-length Unicode code-point escape '\\u{...}', esbuild computes the hex value and rejects it if it exceeds utf8.MaxRune (U+10FFFF). Code points above U+10FFFF are not valid Unicode scalars and cannot be encoded in UTF-8/16, so the escape is illegal.","triggerScenarios":"A '\\u{...}' escape whose hex digits evaluate to > 0x10FFFF, e.g. \"\\u{110000}\", appearing in a string, identifier, or template literal.","commonSituations":"Code generators that splice arbitrary integers into '\\u{}'; copy-paste of surrogate-pair math; misunderstanding that the max code point is U+10FFFF.","solutions":["Use a valid code point (<= U+10FFFF).","If the value is generated, clamp/validate it to the 0..0x10FFFF range before emitting.","Substitute the literal character or a valid \\u escape."],"exampleFix":"// before\nconst x = \"\\u{110000}\"\n// after\nconst x = \"\\u{1F600}\"","handlingStrategy":"validation","validationCode":"import \"github.com/evanw/esbuild/pkg/api\"\nres := api.Transform(src, api.TransformOptions{Loader: api.LoaderJS})\nfor _, m := range res.Errors {\n  if strings.Contains(m.Text, \"Unicode escape sequence is out of range\") {\n    // surface m.Location; reject this input\n  }\n}","typeGuard":"// Validate every \\u{...} in source: value must be <= utf8.MaxRune.\nvar reEsc = regexp.MustCompile(`\\\\u\\{([0-9A-Fa-f]+)\\}`)\nfunc unicodeEscapesValid(src string) bool {\n  for _, m := range reEsc.FindAllStringSubmatch(src, -1) {\n    v, err := strconv.ParseUint(m[1], 16, 32)\n    if err != nil || v > utf8.MaxRune { return false }\n  }\n  return true\n}","tryCatchPattern":null,"preventionTips":["When generating '\\u{}' escapes, clamp the value to [0, 0x10FFFF].","Prefer emitting the literal rune via utf8 encoding over hand-built escapes.","Add a unit test asserting generated escapes are within the valid range."],"tags":["syntax-error","lexer","unicode","string","escaping"],"backgroundTag":null,"analyzedSha":"f6058f8364fe7ab91ca57a83e02577ed74c9cae4","analyzedAt":"2026-08-09T18:37:22.223Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}