{"record":{"id":"14d215b09231568e","repo":"valyala/fasthttp","slug":"invalid-character-n-after-chunk-size","errorCode":null,"errorMessage":"invalid character '\\n' after chunk size","messagePattern":"invalid character '\\\\n' after chunk size","errorType":"exception","errorClass":"ErrBrokenChunk","httpStatus":null,"severity":"error","filePath":"http.go","lineNumber":2994,"sourceCode":"\t\tc, err := r.ReadByte()\n\t\tif err != nil {\n\t\t\treturn -1, ErrBrokenChunk{\n\t\t\t\terror: fmt.Errorf(\"cannot read '\\\\r' char at the end of chunk size: %w\", err),\n\t\t\t}\n\t\t}\n\t\tif c == '\\r' {\n\t\t\tif err := r.UnreadByte(); err != nil {\n\t\t\t\treturn -1, ErrBrokenChunk{\n\t\t\t\t\terror: fmt.Errorf(\"cannot unread '\\\\r' char at the end of chunk size: %w\", err),\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak\n\t\t}\n\t\t// Security: Don't allow newlines in chunk extensions.\n\t\t// This can lead to request smuggling issues with some reverse proxies.\n\t\tif c == '\\n' {\n\t\t\treturn -1, ErrBrokenChunk{\n\t\t\t\terror: errors.New(\"invalid character '\\\\n' after chunk size\"),\n\t\t\t}\n\t\t}\n\t\tif inExt {\n\t\t\tcontinue\n\t\t}\n\t\tswitch c {\n\t\tcase ' ', '\\t':\n\t\t\tafterSizeOWS = true\n\t\t\tcontinue\n\t\tcase ';':\n\t\t\tif afterSizeOWS {\n\t\t\t\treturn -1, ErrBrokenChunk{\n\t\t\t\t\terror: fmt.Errorf(\"invalid character %q after chunk size\", c),\n\t\t\t\t}\n\t\t\t}\n\t\t\tinExt = true\n\t\t\tcontinue\n\t\tdefault:","sourceCodeStart":2976,"sourceCodeEnd":3012,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/http.go#L2976-L3012","documentation":"fasthttp rejects LF (newline) characters appearing in or right after the chunk-size line of a chunked body. Newlines in chunk extensions enable request smuggling through some reverse proxies, so the parser aborts with ErrBrokenChunk wrapping this security error.","triggerScenarios":"A chunk-size line contains a bare '\\n' inside or after chunk extensions, e.g. \"5;ext\\n\\r\"; an attacker-crafted request/response attempting chunk-extension smuggling reaches the parser.","commonSituations":"Malicious clients probing for smuggling vectors; non-conformant servers sending LF-only line endings inside chunk extensions; security scans / fuzzers hitting the endpoint.","solutions":["Fix the sender to use CRLF-terminated chunk lines and avoid newlines in chunk extensions.","If a proxy in front of fasthttp rewrites chunked bodies, upgrade/fix it to preserve proper framing.","Treat occurrences as potential smuggling attempts: log source and consider blocking the client."],"exampleFix":"// before (invalid chunk-size line)\n5;ext\\r\\n  or 5;ex\\nt\\r\\n\n// after (valid)\n5;ext\\r\\nhello\\r\\n0\\r\\n\\r\\n","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"var broken fasthttp.ErrBrokenChunk\nif errors.As(err, &broken) && strings.Contains(broken.Error(), \"invalid character\") {\n    // log source IP, block client: likely smuggling attempt\n    waf.Block(remoteAddr)\n}","preventionTips":["Never accept chunked framing from untrusted clients without a sanitizing proxy.","Keep fasthttp updated for smuggling hardening.","Alert on this error — it usually indicates hostile traffic."],"tags":["http","chunked-encoding","request-smuggling","security"],"backgroundTag":"request-smuggling","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}