danny-avila/LibreChat · error

Remote file response too large: ${buffer.length} bytes

Error message

Remote file response too large: ${buffer.length} bytes

What it means

Thrown by saveFileFromURL after downloading a remote file via axios when the resulting buffer exceeds REMOTE_FILE_FETCH_MAX_BYTES (default 512 MB). Despite axios being configured with maxContentLength and maxBodyLength, this check fires as a post-download defense-in-depth guard for cases where the remote server serves a larger body than its Content-Length header advertised or omits the header entirely. Note: this error is caught internally and the function returns null (does not propagate).

Source

Thrown at api/server/services/Files/Local/crud.js:136

 *
 * @returns {Promise<{ bytes: number, type: string, dimensions: Record<string, number>} | null>}
 *          A promise that resolves to the file metadata if the file is successfully saved, or null if there is an error.
 */
async function saveFileFromURL({ userId, URL, fileName, basePath = 'images' }) {
  try {
    const maxBytes = getRemoteFileFetchMaxBytes();
    const response = await axios({
      url: assertRemoteFileURL(URL),
      responseType: 'arraybuffer',
      timeout: getRemoteFileFetchTimeoutMs(),
      maxContentLength: maxBytes,
      maxBodyLength: maxBytes,
    });
    assertRemoteFileContentLength(response.headers, maxBytes);

    const buffer = Buffer.from(response.data, 'binary');
    if (buffer.length > maxBytes) {
      throw new Error(`Remote file response too large: ${buffer.length} bytes`);
    }

    const { bytes, type, dimensions, extension } = await getBufferMetadata(buffer);

    // Construct the outputPath based on the basePath and userId
    const outputPath = path.join(paths.publicPath, basePath, userId.toString());

    // Check if the output directory exists, if not, create it
    if (!fs.existsSync(outputPath)) {
      fs.mkdirSync(outputPath, { recursive: true });
    }

    // Replace or append the correct extension
    const extRegExp = new RegExp(path.extname(fileName) + '$');
    fileName = fileName.replace(extRegExp, `.${extension}`);
    if (!path.extname(fileName)) {
      fileName += `.${extension}`;
    }

View on GitHub (pinned to 5ff282f900)

Solutions

1. Verify the source URL points to the intended file and not a larger resource (e.g., a full album ZIP instead of a single image).
2. If larger files are legitimate, raise REMOTE_FILE_FETCH_MAX_BYTES in your .env.
3. Pre-check file size with a HEAD request before calling saveFileFromURL.
4. Handle the null return value from saveFileFromURL gracefully in the calling code, surfacing a clear user-facing error.

Example fix

// before
const result = await saveFileFromURL({ userId, URL, fileName });

// after — handle null return (the error is swallowed internally)
const result = await saveFileFromURL({ userId, URL, fileName });
if (!result) {
  throw new Error('File could not be saved from URL. It may exceed the maximum allowed size.');
}

const maxBytes = getRemoteFileFetchMaxBytes();
const head = await axios.head(assertRemoteFileURL(URL), { timeout: 5000 });
const contentLength = parseInt(head.headers['content-length'] ?? '0', 10);
if (contentLength > maxBytes) {
  throw new Error(`File exceeds maximum size of ${maxBytes} bytes`);
}

const result = await saveFileFromURL({ userId, URL, fileName });
if (!result) {
  // saveFileFromURL catches errors internally and returns null
  throw new Error('Failed to save file from URL — it may exceed the size limit');
}

When it happens

Trigger: Calling saveFileFromURL({ userId, URL, fileName }) where the remote host serves a file body larger than the configured max. This fires when the fully buffered response exceeds maxBytes even after axios's own maxContentLength guard and the assertRemoteFileContentLength header check.

Common situations: A user provides a URL to a very large file. The remote CDN uses chunked transfer encoding with no Content-Length, so axios's maxContentLength check is bypassed. Or REMOTE_FILE_FETCH_MAX_BYTES was lowered to a restrictive value. Since saveFileFromURL catches this and returns null, the caller sees a null result rather than an exception.

Related errors

• Remote file response too large: ${buffer.length} bytes
• Path traversal detected in filename
• An error occurred during file upload.
• Avatar response too large: ${buffer.length} bytes
• Request failed with status ${response.status}: ${json.error.

AI-assisted analysis of danny-avila/LibreChat@5ff282f900 (2026-08-12). Data as JSON: /api/errors/755248ecb79612a7. Report an issue: GitHub.