{"id":"792a2e1a85874094","repo":"socketio/socket.io","slug":"too-many-attachments","errorCode":null,"errorMessage":"too many attachments","messagePattern":"too many attachments","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/socket.io-parser/lib/index.ts","lineNumber":246,"sourceCode":"      throw new Error(\"unknown packet type \" + p.type);\n    }\n\n    // look up attachments if type binary\n    if (\n      p.type === PacketType.BINARY_EVENT ||\n      p.type === PacketType.BINARY_ACK\n    ) {\n      const start = i + 1;\n      while (str.charAt(++i) !== \"-\" && i != str.length) {}\n      const buf = str.substring(start, i);\n      if (buf != Number(buf) || str.charAt(i) !== \"-\") {\n        throw new Error(\"Illegal attachments\");\n      }\n      const n = Number(buf);\n      if (!isInteger(n) || n < 1) {\n        throw new Error(\"Illegal attachments\");\n      } else if (n > this.opts.maxAttachments) {\n        throw new Error(\"too many attachments\");\n      }\n      p.attachments = n;\n    }\n\n    // look up namespace (if any)\n    if (\"/\" === str.charAt(i + 1)) {\n      const start = i + 1;\n      while (++i) {\n        const c = str.charAt(i);\n        if (\",\" === c) break;\n        if (i === str.length) break;\n      }\n      p.nsp = str.substring(start, i);\n    } else {\n      p.nsp = \"/\";\n    }\n\n    // look up id","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/socketio/socket.io/blob/ae7fb46e08c5ed964b4a1ea8b1703e816511598e/packages/socket.io-parser/lib/index.ts#L228-L264","documentation":"Thrown by decodeString() when a BINARY_EVENT/BINARY_ACK packet declares more attachments than the decoder's configured maxAttachments limit (default 10, configurable via DecoderOptions). This is a safety guard against memory-exhaustion / DoS from packets claiming huge attachment counts.","triggerScenarios":"Receiving a binary packet whose attachment count (the number between type byte and '-') exceeds this.opts.maxAttachments. With defaults, a frame like '511-...' (11 attachments) throws.","commonSituations":"Legitimately sending many binary buffers (e.g. an array of 15 images) with the default limit of 10; or a malicious/buggy peer crafting a packet with an enormous attachment count.","solutions":["If the high count is legitimate, raise the limit by constructing the Decoder with { maxAttachments: N } (new Decoder({ maxAttachments: 50 })).","Otherwise, reduce the number of binary attachments per packet by chunking or base64-encoding.","Keep a sane cap to prevent abuse; do not set it to Infinity."],"exampleFix":"// before\nconst decoder = new Decoder(); // maxAttachments defaults to 10\n\n// after\nconst decoder = new Decoder({ maxAttachments: 50 });","handlingStrategy":"validation","validationCode":"const MAX = 50; // chosen cap\nfunction withinMax(s, max){\n  const m=s.match(/^[56](\\d+)-/); return !!m && Number(m[1])<=max;\n}","typeGuard":"function fitsAttachmentLimit(s, max){ const m=s.match(/^[56](\\d+)-/); return !!m && Number(m[1])<=max; }","tryCatchPattern":null,"preventionTips":["Construct the Decoder with an explicit maxAttachments appropriate to your payloads.","Chunk large binary sends instead of sending dozens of attachments in one packet.","Keep a finite cap to mitigate DoS; avoid Infinity."],"tags":["parser","binary","attachments","limits","dos"],"analyzedSha":"ae7fb46e08c5ed964b4a1ea8b1703e816511598e","analyzedAt":"2026-08-03T19:08:14.127Z","schemaVersion":2}