What causes "too many attachments" in socketio/socket.io?

If the high count is legitimate, raise the limit by constructing the Decoder with { maxAttachments: N } (new Decoder({ maxAttachments: 50 })).

socketio/socket.io · error · Error

too many attachments

Error message

too many attachments

What it means

Thrown by decodeString() when a BINARY_EVENT/BINARY_ACK packet declares more attachments than the decoder's configured maxAttachments limit (default 10, configurable via DecoderOptions). This is a safety guard against memory-exhaustion / DoS from packets claiming huge attachment counts.

Source

Thrown at packages/socket.io-parser/lib/index.ts:246

      throw new Error("unknown packet type " + p.type);
    }

    // look up attachments if type binary
    if (
      p.type === PacketType.BINARY_EVENT ||
      p.type === PacketType.BINARY_ACK
    ) {
      const start = i + 1;
      while (str.charAt(++i) !== "-" && i != str.length) {}
      const buf = str.substring(start, i);
      if (buf != Number(buf) || str.charAt(i) !== "-") {
        throw new Error("Illegal attachments");
      }
      const n = Number(buf);
      if (!isInteger(n) || n < 1) {
        throw new Error("Illegal attachments");
      } else if (n > this.opts.maxAttachments) {
        throw new Error("too many attachments");
      }
      p.attachments = n;
    }

    // look up namespace (if any)
    if ("/" === str.charAt(i + 1)) {
      const start = i + 1;
      while (++i) {
        const c = str.charAt(i);
        if ("," === c) break;
        if (i === str.length) break;
      }
      p.nsp = str.substring(start, i);
    } else {
      p.nsp = "/";
    }

    // look up id

View on GitHub (pinned to ae7fb46e08)

Solutions

If the high count is legitimate, raise the limit by constructing the Decoder with { maxAttachments: N } (new Decoder({ maxAttachments: 50 })).
Otherwise, reduce the number of binary attachments per packet by chunking or base64-encoding.
Keep a sane cap to prevent abuse; do not set it to Infinity.

Example fix

// before
const decoder = new Decoder(); // maxAttachments defaults to 10

// after
const decoder = new Decoder({ maxAttachments: 50 });

Defensive patterns

Strategy: validation

Validate before calling

const MAX = 50; // chosen cap
function withinMax(s, max){
  const m=s.match(/^[56](\d+)-/); return !!m && Number(m[1])<=max;
}

Type guard

function fitsAttachmentLimit(s, max){ const m=s.match(/^[56](\d+)-/); return !!m && Number(m[1])<=max; }

Prevention

Construct the Decoder with an explicit maxAttachments appropriate to your payloads.
Chunk large binary sends instead of sending dozens of attachments in one packet.
Keep a finite cap to mitigate DoS; avoid Infinity.

When it happens

Trigger: Receiving a binary packet whose attachment count (the number between type byte and '-') exceeds this.opts.maxAttachments. With defaults, a frame like '511-...' (11 attachments) throws.

Common situations: Legitimately sending many binary buffers (e.g. an array of 15 images) with the default limit of 10; or a malicious/buggy peer crafting a packet with an enormous attachment count.

Related errors

AI-assisted analysis of socketio/socket.io@ae7fb46e08 (2026-08-03). Data as JSON: /data/errors/792a2e1a85874094.json. Report an issue: GitHub.