The Pointer Events specification does not specify this. There really is no range; all we know is that user agents will set this to some value larger than 1 (or 1.0) or not.

So, the value could be any positive or negative JavaScript numerical value, though the maximum will probably be no larger than 2 integer digits.

If user agents start reporting really large 64-bit floating point positive or negative values for this, we probably have bigger problems.

Specification has no limits on max number https://w3c.github.io/pointerevents/#dom-navigator-maxtouchpoints

IMPORTANT:

On platforms where the precise number of touch points is not known, the minimum number guaranteed to be recognized is provided. Therefore, it is possible for the number of recognized touch points to exceed the value of maxTouchPoints.

So, if you really cannot have number bigger than something you should limit number by yourself as per your needs.

Because on practice there still could be more touch points than reported by navigator.