sveltejs/kit · error · SvelteKitError

Could not deserialize binary form: invalid file metadata

Error message

Could not deserialize binary form: invalid file metadata

What it means

Each file entry in the binary form payload's metadata must have string name, string type, numeric size, numeric last_modified, and numeric index. deserialize_binary_form throws this when any field is missing or of the wrong type. It prevents malformed metadata from being turned into File objects or used to index the offset table.

Source

Thrown at packages/kit/src/runtime/form-utils.js:296

			throw deserialize_error('invalid file offset table');
		}

		file_offsets = /** @type {Array<number>} */ (parsed_offsets);
		files_start_offset = HEADER_BYTES + data_length + file_offsets_length;
	}

	/** @type {Array<{ offset: number, size: number }>} */
	const file_spans = [];
	const [data, meta] = devalue.parse(text_decoder.decode(data_buffer), {
		File: ([name, type, size, last_modified, index]) => {
			if (
				typeof name !== 'string' ||
				typeof type !== 'string' ||
				typeof size !== 'number' ||
				typeof last_modified !== 'number' ||
				typeof index !== 'number'
			) {
				throw deserialize_error('invalid file metadata');
			}

			let offset = file_offsets[index];

			// Check that the file offset table entry has not been already
			// used. If not, immediately mark it as used.
			if (offset === undefined) {
				throw deserialize_error('duplicate file offset table index');
			}
			file_offsets[index] = undefined;

			offset += files_start_offset;

			file_spans.push({ offset, size });

			return new Proxy(new LazyFile(name, type, size, last_modified, get_chunk, offset), {
				getPrototypeOf() {
					// Trick validators into thinking this is a normal File

View on GitHub (pinned to 03f1687fe6)

Solutions

1. Align @sveltejs/kit versions across client bundle and server runtime.
2. Let SvelteKit produce the request (native form POST or use:enhance) instead of custom serialization.
3. Check for middleware or proxies that alter the JSON section of the body.
4. If you see it from unknown clients, treat it as malformed traffic and reject at the edge.

Example fix

// before: tampered/custom metadata
meta.files = [{ name: 'a.txt', size: '10' }];
// after: only pass through kit-serialized payloads unmodified
const payload = await request.formData(); // handled by kit internals

function validFileMeta(f) {
  return f && typeof f.name === 'string' && typeof f.type === 'string' &&
    typeof f.size === 'number' && typeof f.last_modified === 'number' && typeof f.index === 'number';
}

function isFileMetadata(v) {
  return typeof v === 'object' && v !== null &&
    typeof v.name === 'string' && typeof v.type === 'string' &&
    typeof v.size === 'number' && typeof v.last_modified === 'number' && typeof v.index === 'number';
}

try {
  await deserialize_binary_form(request);
} catch (e) {
  if (String(e.message).includes('invalid file metadata')) {
    return new Response('Malformed file metadata', { status: 400 });
  }
  throw e;
}

When it happens

Trigger: A SvelteKit action request whose per-file metadata record (read from the JSON payload section) is missing fields or has wrong types — caused by truncated/corrupted payload, a mismatched serializer version, or a hand-crafted request.

Common situations: Older clients talking to newer servers (or vice versa) after the binary format changed; request bodies edited by middleware; attackers probing the endpoint with malformed metadata.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not deserialize binary form: invalid file offset table
• Could not deserialize binary form: duplicate file offset tab
• use:enhance can only be used on <form> fields with method="P
• Could not deserialize binary form: file offset table too sho
• Could not deserialize binary form: gaps in file data

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/52d04ad775bbc731. Report an issue: GitHub.