cube-js/cube · error · Error

Incorrect payload size in SASL message: ${payloadSize}

Error message

Incorrect payload size in SASL message: ${payloadSize}

What it means

TSaslTransport.receiveSaslMessage reads the 5-byte SASL frame header (1-byte status + 4-byte big-endian payload size) from the thrift transport. If the declared payload size is larger than the 100MB safety limit (104857600 bytes), the driver refuses to allocate/read it and throws this error. It is a guard against corrupt or malicious framing from the server (or a non-SASL server being spoken to with SASL framing).

Source

Thrown at packages/cubejs-hive-driver/src/TSaslTransport.js:126

      };
    }

    static sendSaslMessage(status, payload, callback) {
      const saslTransport = new thrift.TBufferedTransport(null, callback);
      const messageHeader = Buffer.alloc(5);
      messageHeader.writeInt8(status);
      messageHeader.writeUInt32BE(payload.length, 1);
      saslTransport.write(messageHeader);
      saslTransport.write(payload);
      saslTransport.flush();
    }

    static receiveSaslMessage(transport) {
      const buffer = transport.read(5);
      const status = buffer.readInt8();
      const payloadSize = buffer.readUInt32BE(1);
      if (payloadSize < 0 || payloadSize > 104857600) {
        throw new Error(`Incorrect payload size in SASL message: ${payloadSize}`);
      }
      const payload = transport.read(payloadSize);
      if (status === BAD || status === ERROR) {
        throw new Error(`SASL Error: ${payload.toString('utf-8')}`);
      }
      return { status, payload };
    }
  }

  return TSaslTransport;
};

View on GitHub (pinned to 7d981676b3)

Solutions

1. Verify the server actually uses SASL (QOP/authentication) framing and that the driver is instantiated with matching transport/thrift options
2. Check for a proxy/firewall/middlebox mangling the connection; connect directly to test
3. Restart or re-establish the connection to resync the byte stream; if persistent, inspect server logs for oversized messages
4. As a last resort confirm no legitimate response >100MB is expected; otherwise the framing is corrupt, not a real size issue

Example fix

// before: driver configured for SASL against a non-SASL server
new HiveDriver({ url: 'http://non-sasl-host:10000', ... });
// after: align transport with server (non-SASL http mode, or enable SASL on server)
new HiveDriver({ url: 'http://host:10000', transport: 'http' });

// Probe the server transport before connecting:
const net = require('net');
const s = net.connect(port, host, () => s.end());
s.on('error', () => console.warn('Cannot reach Hive host; SASL framing check skipped'));
// Ensure driver transport matches server: server-side hive.server2.authentication must align with driver options

function isPlausibleSaslFrame(buf) {
  if (!Buffer.isBuffer(buf) || buf.length < 5) return false;
  const payloadSize = buf.readUInt32BE(1);
  return payloadSize >= 0 && payloadSize <= 104857600;
}

try {
  await driver.query(...);
} catch (e) {
  if (String(e.message).startsWith('Incorrect payload size in SASL message')) {
    // reconnect / fall back to non-SASL transport or surface a config hint
  } else throw e;
}

When it happens

Trigger: Server (or proxy) sends a SASL-framed response whose 4-byte length prefix exceeds 104857600 bytes; typically happens when the underlying bytes are not actually SASL-framed (misaligned stream) or a huge payload is returned.

Common situations: Connecting to a Hive/Impala endpoint that does not use SASL (no plain auth / wrong transport type); a proxy or load balancer corrupting the thrift stream; garbage bytes after a handshake desynchronizing the frame reader.

Related errors

• SASL Failed with status ${status}: ${payload.toString('utf-8
• SASL Error: ${payload.toString('utf-8')}
• HTTP error! status: ${response.status}
• unexpected response ${response.statusText}
• Connection check failed: ${errorMessage}

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/ee183f366a3a7050. Report an issue: GitHub.