{"id":"8e582ae1f99c502a","repo":"mongodb/node-mongodb-native","slug":"op-reply-numberreturned-is-an-invalid-array-length","errorCode":null,"errorMessage":"OP_REPLY numberReturned is an invalid array length ${this.numberReturned}","messagePattern":"OP_REPLY numberReturned is an invalid array length (.+?)","errorType":"exception","errorClass":"RangeError","httpStatus":null,"severity":"error","filePath":"src/cmap/commands.ts","lineNumber":381,"sourceCode":"    return this.parsed;\n  }\n\n  parse(): Uint8Array {\n    // Don't parse again if not needed\n    if (this.parsed) return this.sections[0];\n\n    // Position within OP_REPLY at which documents start\n    // (See https://www.mongodb.com/docs/manual/reference/mongodb-wire-protocol/#wire-op-reply)\n    this.index = 20;\n\n    // Read the message body\n    this.responseFlags = readInt32LE(this.data, 0);\n    this.cursorId = new BSON.Long(readInt32LE(this.data, 4), readInt32LE(this.data, 8));\n    this.startingFrom = readInt32LE(this.data, 12);\n    this.numberReturned = readInt32LE(this.data, 16);\n\n    if (this.numberReturned < 0 || this.numberReturned > 2 ** 32 - 1) {\n      throw new RangeError(\n        `OP_REPLY numberReturned is an invalid array length ${this.numberReturned}`\n      );\n    }\n\n    this.cursorNotFound = (this.responseFlags & CURSOR_NOT_FOUND) !== 0;\n    this.queryFailure = (this.responseFlags & QUERY_FAILURE) !== 0;\n    this.shardConfigStale = (this.responseFlags & SHARD_CONFIG_STALE) !== 0;\n    this.awaitCapable = (this.responseFlags & AWAIT_CAPABLE) !== 0;\n\n    // Parse Body\n    for (let i = 0; i < this.numberReturned; i++) {\n      const bsonSize =\n        this.data[this.index] |\n        (this.data[this.index + 1] << 8) |\n        (this.data[this.index + 2] << 16) |\n        (this.data[this.index + 3] << 24);\n\n      const section = this.data.subarray(this.index, this.index + bsonSize);","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/commands.ts#L363-L399","documentation":"Thrown by OpReply.parse() (commands.ts:381) as a RangeError when the OP_REPLY message's numberReturned field is negative or exceeds the maximum representable unsigned 32-bit value. numberReturned tells the driver how many BSON documents follow in the reply; an out-of-range value would cause either an infinite/huge allocation or a negative loop bound when parsing the body.","triggerScenarios":"Server (or intermediary) sent an OP_REPLY whose 4-byte numberReturned field at offset 16 decodes to < 0 or > 2^32-1. OP_REPLY is the legacy wire protocol used by pre-3.2 servers and a few internal paths; a malformed value indicates corruption, a buggy server, or a misbehaving proxy.","commonSituations":"Network corruption truncating or garbling a reply; a non-genuine MongoDB-compatible server/proxy producing malformed OP_REPLY frames; very old server (< 3.2) with a bug. Modern deployments use OP_MSG and never hit this code path.","solutions":["Upgrade the server to 3.2+ which uses OP_MSG instead of OP_REPLY","Inspect the network path for a corrupting proxy or load balancer","If using a MongoDB-compatible emulator, ensure it encodes numberReturned correctly","Report as a driver/server bug with a packet capture if it reproduces against genuine MongoDB"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof RangeError && /numberReturned/i.test(e.message)) {\n    // malformed OP_REPLY - verify server/proxy integrity, upgrade server\n  }\n  throw e;\n}","preventionTips":["Use MongoDB 3.2+ which uses OP_MSG, avoiding OP_REPLY","Inspect proxies/load balancers on the network path","Avoid MongoDB-compatible servers that produce malformed frames"],"tags":["wire-protocol","op-reply","legacy","corruption","range-error"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}