---
title: "Limit how deep code recurses on input · Agent Wranglers"
url: https://agentwranglers.se/playbook/architecture/errors-and-nulls/recursion-depth-limit
id: ARC-82
level: Required
risk: outage
updated: 2026-10-27
build: a2a6bdfed830
tokens: 972
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Limit how deep code recurses on input

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Errors and nulls](https://agentwranglers.se/playbook/architecture/errors-and-nulls.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: ARC-82
- Level: Required
- Chapter: [Errors and nulls](https://agentwranglers.se/playbook/architecture/errors-and-nulls.md)
- Rule: Every recursive function that walks outside input stops at a fixed depth, such as 64 levels, and raises a typed error. Input never decides how deep the stack grows.
- Check: For each recursive walker, a test passes input nested one level past the limit and gets the typed error. A test with 100,000 levels returns the error in under a second, and the process keeps serving.
- Risk: The app down or unusable
- How: A JSON body with 100,000 nested brackets, a deep folder tree or a reply chain of a million comments overflows the stack of naive recursion. CWE-674 lists the result as CPU, memory and stack used up, which crashes the process. Pass the depth down and check it at the top of each call. Or walk the structure with a loop and an explicit stack, capped like any [growing collection](https://agentwranglers.se/playbook/architecture/errors-and-nulls/bounded-collections.md). Cap the size of the request first, as [Cap the size of every request and answer](https://agentwranglers.se/playbook/api-design/requests-and-responses/request-body-limit.md) says. Catch the depth error where input is [parsed at the boundary](https://agentwranglers.se/playbook/architecture/data-shapes/parse-at-the-boundary.md), and answer with a client error.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### TypeScript example

```ts
const MAX_DEPTH = 64;
export class ThreadTooDeep extends Error {}

export function countReplies(comment: Comment, depth = 0): number {
  if (depth > MAX_DEPTH) throw new ThreadTooDeep(`Thread deeper than ${MAX_DEPTH} levels`);
  return comment.replies.reduce((sum, reply) => sum + 1 + countReplies(reply, depth + 1), 0);
}
```

### Python example

```python
MAX_DEPTH = 64

class ThreadTooDeep(ValueError):
    pass

def count_replies(comment: Comment, depth: int = 0) -> int:
    if depth > MAX_DEPTH:
        raise ThreadTooDeep(f"Thread deeper than {MAX_DEPTH} levels")
    return sum(1 + count_replies(reply, depth + 1) for reply in comment.replies)
```

## Sources

- [CWE-674: Uncontrolled Recursion](https://cwe.mitre.org/data/definitions/674.html)

## Related rules

- ARC-34 [Cap every collection that grows with use](https://agentwranglers.se/playbook/architecture/errors-and-nulls/bounded-collections.md) in Clean code and architecture
- API-93 [Cap the size of every request body](https://agentwranglers.se/playbook/api-design/requests-and-responses/request-body-limit.md) in API design
- ARC-53 [Parse input once at the boundary](https://agentwranglers.se/playbook/architecture/data-shapes/parse-at-the-boundary.md) in Clean code and architecture

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/architecture/errors-and-nulls/recursion-depth-limit">Agent Wranglers clean code and architecture playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Never use assertions for checks production needs](https://agentwranglers.se/playbook/architecture/errors-and-nulls/no-assert-in-production-checks.md)
- [Errors and nulls](https://agentwranglers.se/playbook/architecture/errors-and-nulls.md)