danny-avila/LibreChat · warning

Avatar response too large: ${contentLength} bytes

Error message

Avatar response too large: ${contentLength} bytes

What it means

Thrown when the response's `Content-Length` header, parsed as an integer, exceeds MAX_AVATAR_BYTES (10 MB). This is a pre-read guard: it inspects the declared size before buffering the body so a hostile or buggy origin cannot exhaust memory. A missing header (parsed as 0) does not trip this; the post-read guard (error 123) catches that case.

Source

Thrown at api/server/services/Files/images/avatar.js:60

   * `node-fetch` v2's `timeout` is the total request budget (request initiation
   * through full body receipt), not a TCP-connect-only timeout. That is the
   * stronger of the two for this path — bounds total slow-loris exposure.
   */
  const response = await fetch(parsed.href, {
    headers: fetchOptions.headers,
    agent: (urlObj) => (urlObj.protocol === 'https:' ? httpsAgent : httpAgent),
    redirect: 'error',
    timeout: 5000,
    size: MAX_AVATAR_BYTES,
  });

  if (!response.ok) {
    throw new Error(`Failed to fetch image from URL. Status: ${response.status}`);
  }

  const contentLength = parseInt(response.headers.get('content-length') ?? '0', 10);
  if (contentLength > MAX_AVATAR_BYTES) {
    throw new Error(`Avatar response too large: ${contentLength} bytes`);
  }

  /**
   * Re-check after read in case the server lied about Content-Length or
   * omitted it. `node-fetch` v2 honors the `size` option above and throws on
   * overflow, but Defense-in-depth: assert on the actual buffer length.
   */
  const buffer = await response.buffer();
  if (buffer.length > MAX_AVATAR_BYTES) {
    throw new Error(`Avatar response too large: ${buffer.length} bytes`);
  }
  return buffer;
}

/**
 * Uploads an avatar image for a user. This function can handle various types of input (URL, Buffer, or File object),
 * processes the image to a square format, converts it to target format, and returns the resized buffer.
 *

View on GitHub (pinned to 5ff282f900)

Solutions

1. Point the avatar URL at a properly sized thumbnail (a few hundred KB), not the original upload.
2. If you control the origin, configure it to serve a < 10 MB derivative for the avatar route.
3. Pre-check the URL's HEAD response Content-Length in the caller and reject early with a user-facing message.
4. Increase MAX_AVATAR_BYTES only if you genuinely need larger avatars (not recommended — sharp will resize down anyway).

Example fix

// before
await fetchAvatarBuffer('https://cdn.example.com/user/original-raw.dng');

// after: caller pre-check
const head = await fetch(url, { method: 'HEAD' });
const len = parseInt(head.headers.get('content-length') ?? '0', 10);
if (len > 10 * 1024 * 1024) throw new Error('Avatar too large; please use a smaller image.');
await fetchAvatarBuffer(url);

const MAX = 10 * 1024 * 1024;
async function assertAvatarSize(url) {
  const head = await fetch(url, { method: 'HEAD', timeout: 5000 });
  const len = parseInt(head.headers.get('content-length') ?? '0', 10);
  if (len > MAX) throw new Error(`Avatar too large (${len} bytes) before download`);
}

try { await fetchAvatarBuffer(url); }
catch (e) {
  if (/Avatar response too large/.test(e.message)) return res.status(413).json({ error: 'Avatar image too large; please use a smaller one.' });
  throw e;
}

When it happens

Trigger: Avatar URL points to a high-resolution uncropped source image, a video mislabeled as an image, or a malicious payload whose declared Content-Length is over 10 MB. Also a CDN returning the wrong (huge) Content-Length for a small body.

Common situations: Users pasting a link to a raw camera RAW or print-resolution photo as their avatar; a CDN misconfiguration serving a multi-GB master instead of a thumbnail; an attacker probing the size cap with synthetic payloads.

Related errors

• Avatar response too large: ${buffer.length} bytes
• Remote file response too large: ${buffer.length} bytes
• Remote file response too large: ${buffer.length} bytes
• Invalid avatar URL
• Refusing to fetch avatar over ${parsed.protocol}

AI-assisted analysis of danny-avila/LibreChat@5ff282f900 (2026-08-12). Data as JSON: /api/errors/c2f8ee14f72ab6b9. Report an issue: GitHub.