denoland/deno · error · RangeError

Attempt to allocate Buffer larger than maximum size: 0x${kMa

Error message

Attempt to allocate Buffer larger than maximum size: 0x${kMaxLength} bytes

What it means

checked(length) guards array-like-to-Buffer conversions (fromArrayLike, SlowBuffer) and throws a RangeError ('Attempt to allocate Buffer larger than maximum size: 0x...') at buffer.mjs:518-519 when length >= kMaxLength. In this polyfill kMaxLength is Number.MAX_SAFE_INTEGER (buffer.mjs:147), so it effectively fires only on degenerate computed lengths such as Infinity; on Node the ceiling is 2^32-1 and real oversized conversions throw there. It prevents a single allocation from exceeding the maximum Buffer size.

Source

Thrown at ext/node/polyfills/internal/buffer.mjs:519

function fromObject(obj) {
  // deno-lint-ignore deno-internal/prefer-primordials
  if (obj.length !== undefined || isAnyArrayBuffer(obj.buffer)) {
    if (typeof obj.length !== "number") {
      return createBuffer(0);
    }

    return fromArrayLike(obj);
  }

  if (obj.type === "Buffer" && ArrayIsArray(obj.data)) {
    return fromArrayLike(obj.data);
  }
}

function checked(length) {
  if (length >= kMaxLength) {
    throw new RangeError(
      "Attempt to allocate Buffer larger than maximum size: 0x" +
        NumberPrototypeToString(kMaxLength, 16) + " bytes",
    );
  }
  return MathTrunc(length);
}

function SlowBuffer(length) {
  if (!slowBufferWarningAlreadyEmitted) {
    slowBufferWarningAlreadyEmitted = true;
    process.emitWarning(slowBufferWarning, "DeprecationWarning", "DEP0030");
  }
  assertSize(length);
  return _alloc(+length);
}

ObjectSetPrototypeOf(SlowBuffer.prototype, Uint8ArrayPrototype);

View on GitHub (pinned to 9ad36f7a2c)

Solutions

Validate the length before converting: require a finite, safe integer within buffer.constants.MAX_LENGTH
Chunk large conversions: convert array-likes in slices instead of one Buffer.from
Treat declared lengths from untrusted sources as hostile: cap them early with a clear error
For files and streams, use streaming reads (fs.createReadStream) rather than whole-entity buffers

Example fix

// before
const buf = Buffer.from(items); // items.length may be Infinity

// after
if (!Number.isSafeInteger(items.length) || items.length < 0 ||
    items.length >= buffer.constants.MAX_LENGTH) {
  throw new RangeError(`invalid source length: ${items.length}`);
}
const buf = Buffer.from(items);

Defensive patterns

Strategy: validation

Validate before calling

import buffer from 'node:buffer';

function assertSourceLength(len) {
  if (!Number.isSafeInteger(len) || len < 0 ||
      len >= buffer.constants.MAX_LENGTH) {
    throw new RangeError('invalid source length: ' + String(len));
  }
}

assertSourceLength(items.length);
const buf = Buffer.from(items);

Try / catch

try {
  result = Buffer.from(source);
} catch (err) {
  if (err instanceof RangeError && /maximum size/.test(String(err.message))) {
    result = Buffer.concat(chunkify(source)); // split and stream in chunks
  } else {
    throw err;
  }
}

Prevention

Distrust length-like properties from untrusted or tampered sources
Chunk big conversions instead of one Buffer.from call
Use fs streams for file-sized data; never materialize whole entities when streaming works

When it happens

Trigger: Buffer.from(arrayLike) where arrayLike.length is Infinity or a corrupted huge number (sparse arrays with tampered length, broken .length getters); SlowBuffer(Infinity) or SlowBuffer with an overflowed computed size; feeding objects whose length getter returns garbage (divide-by-zero scaling) into Buffer.from.

Common situations: Protocols trusting a declared count and materializing arrays of that size; math errors producing Infinity sizes; code ported from platforms with different maxima; memory-pressure fallbacks that try to buffer everything at once.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/2dfbfa7c7bcbb3b1. Report an issue: GitHub.