nats-io/nats-server · error
processPub Bad or Missing Size: %q
Error message
processPub Bad or Missing Size: %q
What it means
The size field of a PUB operation parsed to a negative value. parseSize() returns -1 when the token is missing, non-numeric, negative, or overflows int64, so the server rejects the publish and closes the connection.
Source
Thrown at server/client.go:2991
c.pa.arg = arg
switch len(args) {
case 2:
c.pa.subject = args[0]
c.pa.reply = nil
c.pa.size = parseSize(args[1])
c.pa.szb = args[1]
case 3:
c.pa.subject = args[0]
c.pa.reply = args[1]
c.pa.size = parseSize(args[2])
c.pa.szb = args[2]
default:
return fmt.Errorf("processPub Parse Error: %q", arg)
}
// If number overruns an int64, parseSize() will have returned a negative value
if c.pa.size < 0 {
return fmt.Errorf("processPub Bad or Missing Size: %q", arg)
}
maxPayload := atomic.LoadInt32(&c.mpay)
// Use int64() to avoid int32 overrun...
if maxPayload != jwt.NoLimit && int64(c.pa.size) > int64(maxPayload) {
c.maxPayloadViolation(c.pa.size, maxPayload)
return ErrMaxPayload
}
if c.opts.Pedantic && !IsValidLiteralSubject(bytesToString(c.pa.subject)) {
c.sendErr("Invalid Publish Subject")
}
return nil
}
func splitArg(arg []byte) [][]byte {
a := [MAX_MSG_ARGS][]byte{}
args := a[:0]
start := -1
for i, b := range arg {View on GitHub (pinned to 3a66a489d2)
Solutions
- Fix the client to send the actual payload byte length as a non-negative decimal integer
- Check the client code for signed-size or int64-overflow calculations on large payloads
- Capture traffic/debug logs to identify the malformed PUB line and offending client
Example fix
// before PUB subj -1 // after PUB subj 5 hello
Defensive patterns
Strategy: validation
Validate before calling
size := len(payload)
if size < 0 || size > math.MaxInt32 {
return errors.New("PUB size out of range")
}
frame := fmt.Sprintf("PUB %s %d\r\n", subject, size) Type guard
func isNonNegativeSize(token string) (int64, bool) {
n, err := strconv.ParseInt(token, 10, 64)
return n, err == nil && n >= 0
} Prevention
- Send len(payload) as the size, computed as unsigned/int64 then bounded
- Guard against int64 overflow for very large payloads
- Never use -1 as a size sentinel
When it happens
Trigger: Client sends `PUB <subject> <size>` (or with reply) where size is non-numeric or overflows int64, e.g. `PUB foo abc` or `PUB foo 99999999999999999999`, so c.pa.size < 0.
Common situations: Client computing payload length with a signed/overflowing type, passing -1 as a sentinel size, corrupted frames from the network.
Related errors
- processHeaderPub Bad or Missing Total Size: %q
- processHeaderPub Bad or Missing Header Size: %q
- processHeaderPub Header Size larger then TotalSize: %q
- processPub Parse Error: %q
- processSub Parse Error: %q
AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02).
Data as JSON: /api/errors/fe5fdd9f3985ca05.
Report an issue: GitHub.