{"record":{"id":"f21dbea49bda1113","repo":"projectdiscovery/nuclei","slug":"http-response-body-exceeds-d-bytes","errorCode":null,"errorMessage":"http: response body exceeds %d bytes","messagePattern":"http: response body exceeds (.+?) bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/js/libs/http/http.go","lineNumber":356,"sourceCode":"\tif req.Header.Get(\"User-Agent\") == \"\" {\n\t\treq.Header.Set(\"User-Agent\", \"Nuclei\")\n\t}\n\n\tresp, err := httpClient.Do(req)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer func() {\n\t\t_ = resp.Body.Close()\n\t}()\n\n\tlimited := io.LimitReader(resp.Body, int64(c.MaxBodyBytes)+1)\n\traw, err := io.ReadAll(limited)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif len(raw) > c.MaxBodyBytes {\n\t\treturn nil, fmt.Errorf(\"http: response body exceeds %d bytes\", c.MaxBodyBytes)\n\t}\n\n\tout := &Response{\n\t\tStatusCode: resp.StatusCode,\n\t\tURL:        resp.Request.URL.String(),\n\t\tBody:       string(raw),\n\t\tHeaders:    flattenHeaders(resp.Header),\n\t\theader:     resp.Header.Clone(),\n\t}\n\treturn out, nil\n}\n\nfunc executionIDFrom(ctx context.Context, c *Client) string {\n\tif c != nil && c.nj != nil {\n\t\tif id := c.nj.ExecutionId(); id != \"\" {\n\t\t\treturn id\n\t\t}\n\t}","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/http/http.go#L338-L374","documentation":"The response body was larger than MaxBodyBytes (default 5 MiB): the body is read through io.LimitReader(MaxBodyBytes+1) and a read that exceeds the cap aborts instead of returning a truncated body. This bounds per-request memory in JS templates; the whole request fails even though headers were received.","triggerScenarios":"Hitting file downloads, ISOs, packages, or large JSON/XML exports with the default 5 MiB cap; Options.MaxBodyBytes configured lower than the target's normal response size; streaming endpoints that emit unbounded payloads.","commonSituations":"Templates checking artifact repositories (npm/maven/oci manifests), sitemap.xml or dump endpoints; bandwidth-conscious scans lowering MaxBodyBytes; using the error itself as a big-content detector.","solutions":["Raise the cap to match the asset: const o = new http.Options(); o.MaxBodyBytes = 20 * 1024 * 1024;","Use HEAD requests when only status/headers matter","Treat the error as a signal: 'body exceeds N bytes' can itself be the detection condition for large-file exposure"],"exampleFix":"// before: default 5 MiB cap, artifact endpoint returns far more\nconst resp = client.Get('https://repo.acme.com/pkg/latest.rpm'); // -> exceeds 5242880 bytes\n\n// after: size the cap to the expected asset\nconst o = new http.Options();\no.MaxBodyBytes = 100 * 1024 * 1024;\nconst client = new http.Client(o);\nconst resp = client.Get('https://repo.acme.com/pkg/latest.rpm');","handlingStrategy":"fallback","validationCode":"const o = new http.Options();\no.MaxBodyBytes = 100 * 1024 * 1024; // size the cap to the largest asset you intend to read\nconst client = new http.Client(o);","typeGuard":null,"tryCatchPattern":"let resp;\ntry {\n  resp = client.Get(url);\n} catch (e) {\n  if (/response body exceeds/.test(e.message || '')) {\n    // either retry with a larger MaxBodyBytes client, treat as large-content signal, or switch to HEAD\n  }\n}","preventionTips":["Configure MaxBodyBytes to the expected asset size before scanning download endpoints","Prefer HEAD requests when only status/headers are needed","Remember the cap is strict: one byte over and the whole request fails with no partial body"],"tags":["http","body-limit","javascript","configuration"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}