zloirock/core-js · error · SyntaxError

Missing padding

Error message

Missing padding

What it means

With lastChunkHandling 'strict', Uint8Array.fromBase64 requires the final chunk to be properly '=' padded. If the input ends with an unpadded 2- or 3-character chunk, the polyfill throws this SyntaxError ('Missing padding') — strict mode accepts only canonical, fully padded base64 or complete 4-char groups.

Source

Thrown at packages/core-js/internals/uint8-from-base64.js:106

  var written = 0;
  var read = 0;
  var chunk = '';
  var index = 0;

  if (maxLength) while (true) {
    index = skipAsciiWhitespace(string, index);
    if (index === stringLength) {
      if (chunk.length > 0) {
        if (lastChunkHandling === 'stop-before-partial') {
          break;
        }
        if (lastChunkHandling === 'loose') {
          if (chunk.length === 1) {
            throw new SyntaxError('Malformed padding: exactly one additional character');
          }
          written = writeBytes(bytes, decodeBase64Chunk(chunk, alphabet, false), written);
        } else {
          throw new SyntaxError('Missing padding');
        }
      }
      read = stringLength;
      break;
    }
    var chr = at(string, index);
    ++index;
    if (chr === '=') {
      if (chunk.length < 2) {
        throw new SyntaxError('Padding is too early');
      }
      index = skipAsciiWhitespace(string, index);
      if (chunk.length === 2) {
        if (index === stringLength) {
          if (lastChunkHandling === 'stop-before-partial') {
            break;
          }
          throw new SyntaxError('Malformed padding: only one =');

View on GitHub (pinned to 84e45fba09)

Solutions

1. Use lastChunkHandling: 'loose' (default) or 'stop-before-partial' for padless input.
2. Restore '=' padding before decoding: pad to a multiple of 4 with '='.
3. Use a base64url-aware decoder (Uint8Array.fromBase64 with alphabet: 'base64url') and non-strict mode for JWT-style data.
4. Have the encoder emit standard padded base64.

Example fix

// before
Uint8Array.fromBase64('QUI', { lastChunkHandling: 'strict' }); // SyntaxError: Missing padding
// after
let s = 'QUI';
s += '='.repeat((4 - (s.length % 4)) % 4); // 'QUI='
Uint8Array.fromBase64(s, { lastChunkHandling: 'strict' });

function ensurePadded(b64) {
  const s = b64.replace(/\s/g, '');
  return s + '='.repeat((4 - (s.length % 4)) % 4);
}
const padded = ensurePadded(input);

function isPaddedOrComplete(s) { const n = s.replace(/\s/g,'').length % 4; return n === 0 || n === 1 ? n === 0 : true; }

try {
  bytes = Uint8Array.fromBase64(b64, { lastChunkHandling: 'strict' });
} catch (e) {
  if (e instanceof SyntaxError && e.message === 'Missing padding') {
    const s = b64.replace(/\s/g, '') + '='.repeat((4 - (b64.replace(/\s/g, '').length % 4)) % 4);
    bytes = Uint8Array.fromBase64(s, { lastChunkHandling: 'strict' });
  } else throw e;
}

When it happens

Trigger: `Uint8Array.fromBase64('QUI', { lastChunkHandling: 'strict' })` — the 3-char tail lacks '='; likewise a 2-char tail like 'QQ' without '==' under strict mode.

Common situations: URL-safe/padless base64 (as used in JWTs) fed into strict fromBase64, base64url encoders that omit '=' by convention, or piping JWT segments / padded-less encoder output into a strict decoder.

Related errors

• Malformed padding: exactly one additional character
• Extra bits
• Incorrect `lastChunkHandling` option
• Padding is too early
• Malformed padding: only one =

AI-assisted analysis of zloirock/core-js@84e45fba09 (2026-08-30). Data as JSON: /api/errors/715faef226f3caec. Report an issue: GitHub.