nodejs/node · error · OverflowError

range too big, maximum size for range is %d

Error message

range too big, maximum size for range is %d

What it means

Raised by safe_range inside jinja2.sandbox when the requested range would produce more than MAX_RANGE elements. SandboxedEnvironment replaces the builtin range with safe_range to prevent templates from exhausting memory/CPU with range(10**12). The error is an OverflowError so it surfaces as a resource-limit violation rather than a normal logic error.

Source

Thrown at tools/inspector_protocol/jinja2/sandbox.py:153

def inspect_format_method(callable):
    if not isinstance(callable, (types.MethodType,
                                 types.BuiltinMethodType)) or \
       callable.__name__ != 'format':
        return None
    obj = callable.__self__
    if isinstance(obj, string_types):
        return obj


def safe_range(*args):
    """A range that can't generate ranges with a length of more than
    MAX_RANGE items.
    """
    rng = range(*args)
    if len(rng) > MAX_RANGE:
        raise OverflowError('range too big, maximum size for range is %d' %
                            MAX_RANGE)
    return rng


def unsafe(f):
    """Marks a function or method as unsafe.

    ::

        @unsafe
        def delete(self):
            pass
    """
    f.unsafe_callable = True
    return f


def is_internal_attribute(obj, attr):

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Bound the argument before calling range: {{ range(min(n, 10000)) }}.
2. Re-examine the logic: usually range() in templates should be range(page_size), not range(total).
3. If a larger cap is genuinely needed and the environment is trusted, subclass SandboxedEnvironment and override is_safe_range / set a higher MAX_RANGE constant - document the risk.
4. Sanitize context variables in Python before render: ctx['n'] = min(ctx['n'], HARD_CAP).

Example fix

// before
<ul>
{% for i in range(user_count) %}<li>{{ i }}</li>{% endfor %}
</ul>
// after
<ul>
{% for i in range(user_count if user_count < 1000 else 1000) %}<li>{{ i }}</li>{% endfor %}
</ul>

from jinja2.sandbox import MAX_RANGE
ctx = dict(user_ctx)
for k, v in list(ctx.items()):
    if isinstance(v, int) and abs(v) > MAX_RANGE:
        ctx[k] = MAX_RANGE if v > 0 else -MAX_RANGE
# then render with ctx

def within_range_bound(n, cap) -> bool:
    try:
        return abs(int(n)) <= cap
    except (TypeError, ValueError):
        return False

from jinja2.exceptions import TemplateRuntimeError, OverflowError as JOverflow
try:
    html = env.from_string(tpl).render(**ctx)
except OverflowError:
    html = env.from_string(fallback_tpl).render(**bounded(ctx))

When it happens

Trigger: A template under SandboxedEnvironment calls {{ range(1, 1000000000) }} or {{ range(n) }} where n is supplied by user input and exceeds MAX_RANGE (default 1<<25 = ~33M). Feeding an untrusted context variable into range() without bounds. Pagination logic that computes range(total_items) instead of range(page_size).

Common situations: Rendering templates against untrusted input in a sandbox (web app, report generator). Bad math from upstream producing huge counts. Migrating a template from a non-sandboxed environment where range() was unbounded.

Related errors

• %r is not safely callable
• Content-Length mismatch
• server does not support the range header and the payload was
• Content-Range mismatch
• ETag mismatch

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/7cbb8352588aeda9. Report an issue: GitHub.