usebruno/bruno · error · Error

getRandomValues: ArrayBufferView byte length exceeds 65536

Error message

getRandomValues: ArrayBufferView byte length exceeds 65536

What it means

Thrown by the QuickJS sandbox crypto shim for crypto.getRandomValues when the supplied typed array's length exceeds 65536 bytes. The Web Crypto spec (and browsers) cap crypto.getRandomValues at 65536 bytes; the shim enforces the same cap. The input is deserialized from the sandbox before the check.

Source

Thrown at packages/bruno-js/src/sandbox/quickjs/shims/lib/crypto-utils.js:56

      const vmError = vm.newError(error.message);
      vm.setProp(vmError, 'name', vm.newString(error.name));

      throw vmError;
    }
  });

  let getRandomValuesHandle = vm.newFunction('getRandomValues', function (arrayHandle) {
    try {
      // Receive the serialized array data directly
      const serializedArray = vm.dump(arrayHandle);
      const typedArray = deserializeTypedArray(serializedArray);

      if (typedArray.length === 0) {
        return marshallToVm([], vm);
      }

      if (typedArray.length > 65536) {
        throw new Error('getRandomValues: ArrayBufferView byte length exceeds 65536');
      }

      crypto.getRandomValues(typedArray);

      const byteArray = Array.from(typedArray);

      return marshallToVm(byteArray, vm);
    } catch (error) {
      const vmError = vm.newError(error.message);
      vm.setProp(vmError, 'name', vm.newString(error.name));

      throw vmError;
    }
  });

  // Set the functions in global context
  vm.setProp(vm.global, '__bruno__crypto__randomBytes', randomBytesHandle);
  vm.setProp(vm.global, '__bruno__crypto__getRandomValues', getRandomValuesHandle);

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Allocate a typed array of <= 65536 bytes: `crypto.getRandomValues(new Uint8Array(32))`.
2. If more randomness is required, fill in chunks across multiple calls.
3. Cap the length from untrusted sources: `new Uint8Array(Math.min(n, 65536))`.

Example fix

// before
crypto.getRandomValues(new Uint8Array(100000));

// after
const buf = new Uint8Array(32);
crypto.getRandomValues(buf);

function safeGetRandomValues(ta) {
  if (ta.length > 65536) throw new RangeError('typed array too large');
  return crypto.getRandomValues(ta);
}

const isSmallTypedArray = (v) => ArrayBuffer.isView(v) && v.length <= 65536;

try { crypto.getRandomValues(arr); }
catch (err) {
  if (/exceeds 65536/.test(err.message)) { /* shrink array, retry */ }
  else throw err;
}

When it happens

Trigger: Calling crypto.getRandomValues(new Uint8Array(70000)) or any typed array whose byte length exceeds 65536 inside a QuickJS-sandboxed Bru script.

Common situations: Generating a large nonce, IV, or salt with an unbounded length; passing the whole payload buffer instead of a fixed-size nonce; reusing a buffer sized from a response field.

Related errors

• The "size" argument must be >= 0
• The "size" argument is too large
• getRandomValues: Invalid typed array object
• getRandomValues: Invalid or unsupported typed array type: ${
• getRandomValues: Invalid typed array properties

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/973106d73e1c4460. Report an issue: GitHub.