usebruno/bruno · error · RangeError

The "size" argument is too large

Error message

The "size" argument is too large

What it means

Thrown by the QuickJS sandbox crypto shim for crypto.randomBytes when `size` exceeds 65536. The cap protects the sandbox host from a single oversized allocation; it mirrors the kind of guard Node applies to random byte generation. The comment in source labels 65536 as a practical safe ceiling.

Source

Thrown at packages/bruno-js/src/sandbox/quickjs/shims/lib/crypto-utils.js:25

 * Implements crypto.randomBytes and crypto.getRandomValues functions
 */
const addCryptoUtilsShimToContext = async (vm) => {
  let randomBytesHandle = vm.newFunction('randomBytes', function (sizeHandle) {
    try {
      let size = vm.dump(sizeHandle);

      if (typeof size !== 'number') {
        throw new TypeError('The "size" argument must be of type number');
      }

      size = Math.trunc(size);

      if (size < 0) {
        throw new RangeError('The "size" argument must be >= 0');
      }

      if (size > 65536) { // 2^31 - 1 (max safe integer for practical use)
        throw new RangeError('The "size" argument is too large');
      }

      if (size === 0) {
        return marshallToVm([], vm);
      }

      const buffer = crypto.randomBytes(size);

      const byteArray = Array.from(buffer);

      return marshallToVm(byteArray, vm);
    } catch (error) {
      const vmError = vm.newError(error.message);
      vm.setProp(vmError, 'name', vm.newString(error.name));

      throw vmError;
    }
  });

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Lower the requested size to <= 65536 bytes.
2. If a larger buffer is genuinely needed, accumulate across multiple randomBytes calls in a loop.
3. Cap untrusted input: `const n = Math.min(requested, 65536)`.

Example fix

// before
crypto.randomBytes(200000); // too large

// after — chunk if you truly need more
function bigRandom(total) {
  const out = [];
  for (let i = 0; i < total; i += 65536) {
    out.push(...crypto.randomBytes(Math.min(65536, total - i)));
  }
  return out;
}

const MAX = 65536;
function safeRandomBytes(size) {
  const n = Math.trunc(Number(size));
  if (n > MAX) throw new RangeError('size too large');
  return crypto.randomBytes(n);
}

const isWithinCap = (v) => Number.isInteger(v) && v >= 0 && v <= 65536;

try { crypto.randomBytes(n); }
catch (err) {
  if (/too large/.test(err.message)) { crypto.randomBytes(Math.min(65536, n)); }
  else throw err;
}

When it happens

Trigger: Passing a large literal (e.g. crypto.randomBytes(100000)) or a computed size that grows unbounded (e.g. derived from a response payload length).

Common situations: Generating a one-time pad or test blob with an unreasonably large size; size read from an untrusted input without an upper bound; unit confusion (KB vs bytes).

Related errors

• The "size" argument must be >= 0
• The "size" argument must be of type number
• getRandomValues: ArrayBufferView byte length exceeds 65536
• getRandomValues: Invalid typed array object
• getRandomValues: Invalid or unsupported typed array type: ${

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/1614a00e7adaa076. Report an issue: GitHub.