denoland/deno · error · NodeError

ERR_OSSL_BN_BIGNUM_TOO_LONG

ERR_OSSL_BN_BIGNUM_TOO_LONG

Error message

bignum too long

What it means

Thrown by checkPrime() in Deno's node:crypto polyfill (ext/node/polyfills/internal/crypto/random.ts:102) when the candidate ArrayBuffer/TypedArray/Buffer/DataView exceeds OPENSSL_BIGNUM_MAX_BYTES (67,108,856 bytes, the OpenSSL BIGNUM word limit). OpenSSL cannot represent a bignum larger than this, so the input is rejected before the primality op runs.

Source

Thrown at ext/node/polyfills/internal/crypto/random.ts:102

  const {
    checks = 0,
  } = options!;

  validateInt32(checks, "options.checks", 0);

  let candidateBytes: ArrayBufferView | ArrayBuffer;
  if (typeof candidate === "bigint") {
    if (candidate < 0) {
      throw new ERR_OUT_OF_RANGE("candidate", ">= 0", candidate);
    }
    candidateBytes = bigintToBytes(candidate);
  } else if (isAnyArrayBuffer(candidate) || isArrayBufferView(candidate)) {
    const byteLength = isArrayBufferView(candidate)
      ? arrayBufferViewByteLength(candidate as ArrayBufferView)
      : ArrayBufferPrototypeGetByteLength(candidate as ArrayBuffer);
    if (byteLength > OPENSSL_BIGNUM_MAX_BYTES) {
      throw new NodeError(
        "ERR_OSSL_BN_BIGNUM_TOO_LONG",
        "bignum too long",
      );
    }
    candidateBytes = candidate;
  } else {
    throw new ERR_INVALID_ARG_TYPE(
      "candidate",
      [
        "ArrayBuffer",
        "TypedArray",
        "Buffer",
        "DataView",
        "bigint",
      ],
      candidate,
    );
  }

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Check the byteLength of the candidate buffer — if it is near or above 64MiB you almost certainly passed the wrong object.
2. If you built the buffer from a BigInt, pass the BigInt itself so bigintToBytes produces a minimal byte representation.
3. Verify your bit/byte math: a 2048-bit prime needs a 256-byte buffer, not a 2048-byte one.

Example fix

// before
crypto.checkPrime(hugeBuffer, cb);

// after
const bits = 2048;
const buf = new Uint8Array(bits / 8); // bytes, not bits
crypto.checkPrime(buf, cb);

const MAX_BN = 67108856;
const bytes = ArrayBuffer.isView(c) ? c.byteLength : c.byteLength;
if (bytes > MAX_BN) throw new Error('candidate too large for OpenSSL bignum');

null

try { crypto.checkPrime(c, cb); } catch (e) { if (e.code === 'ERR_OSSL_BN_BIGNUM_TOO_LONG') { /* wrong buffer passed — log size and fix caller */ } else throw e; }

When it happens

Trigger: crypto.checkPrime(new Uint8Array(67_108_857)) or passing an ArrayBuffer whose byteLength is greater than 67108856 (a ~64MiB integer, i.e. a >536-million-bit number).

Common situations: Almost always a bug: a buffer of the wrong size passed by mistake (e.g. a whole file or key blob), a length calculation in bits vs bytes, or a huge preallocated buffer that was never filled.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ERR_OUT_OF_RANGE
• ERR_INVALID_ARG_TYPE
• ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED
• ERR_INVALID_ARG_TYPE
• ERR_INVALID_ARG_TYPE

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/21d45bb760497f4b. Report an issue: GitHub.