{"record":{"id":"4d37e9221bd0bf4c","repo":"vercel/next.js","slug":"invalid-options-type-header","errorCode":null,"errorMessage":"Invalid ${options.type} header","messagePattern":"Invalid (.+?) header","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/next/src/server/accept-header.ts","lineNumber":50,"sourceCode":"          }\n        }\n      }\n    }\n  }\n\n  const parts = header.split(',')\n  const selections: Selection[] = []\n  const map = new Set<string>()\n\n  for (let i = 0; i < parts.length; ++i) {\n    const part = parts[i]\n    if (!part) {\n      continue\n    }\n\n    const params = part.split(';')\n    if (params.length > 2) {\n      throw new Error(`Invalid ${options.type} header`)\n    }\n\n    let token = params[0].toLowerCase()\n    if (!token) {\n      throw new Error(`Invalid ${options.type} header`)\n    }\n\n    const selection: Selection = { token, pos: i, q: 1 }\n    if (preferences && lowers.has(token)) {\n      selection.pref = lowers.get(token)!.pos\n    }\n\n    map.add(selection.token)\n\n    if (params.length === 2) {\n      const q = params[1]\n      const [key, value] = q.split('=')\n","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/vercel/next.js/blob/0ae8c72462952df163f1b1e0726641bc5b40dc93/packages/next/src/server/accept-header.ts#L32-L68","documentation":"Thrown by the accept-header parser when a single comma-separated part of the Accept-Language header contains more than one semicolon parameter (params.length > 2). A valid token allows at most one q-parameter (e.g. 'en;q=0.8'); extra parameters like 'en;q=0.8;x=y' are invalid per the parsing grammar Next.js enforces.","triggerScenarios":"An Accept-Language header value where a segment has two or more ';' parameters, e.g. 'en;q=0.8;extra=1'. The split(';') yields 3+ elements, hitting the throw at line 50.","commonSituations":"A misbehaving client/proxy injecting extra parameters; manual header crafting in tests; a CDN rewriting headers. Real browsers do not produce this, so it usually indicates a malformed or tampered request.","solutions":["Sanitize or reject the incoming Accept-Language header before passing it to acceptLanguage().","Identify the client/proxy producing the malformed header and fix it at the source.","Wrap the acceptLanguage() call in try/catch and fall back to a default locale."],"exampleFix":"// before\nconst locale = acceptLanguage(req.headers['accept-language'], ['en', 'fr'])\n// after - guard against malformed headers\nfunction safeAcceptLanguage(header, prefs, fallback) {\n  try { return acceptLanguage(header, prefs) || fallback }\n  catch { return fallback }\n}\nconst locale = safeAcceptLanguage(req.headers['accept-language'], ['en', 'fr'], 'en')","handlingStrategy":"try-catch","validationCode":"function sanitizeAcceptLanguage(header: string): string {\n  return header.split(',').map(seg => {\n    const parts = seg.trim().split(';')\n    if (parts.length > 2) return parts[0] + (parts[1] ? ';' + parts[1] : '')\n    return seg.trim()\n  }).join(',')\n}","typeGuard":null,"tryCatchPattern":"try {\n  const locale = acceptLanguage(header, prefs)\n} catch {\n  locale = 'en' // fallback\n}","preventionTips":["Always wrap acceptLanguage() in try/catch with a fallback locale.","Sanitize incoming Accept-Language before parsing.","Log malformed headers to identify misbehaving clients/proxies."],"tags":["accept-header","i18n","request-parsing","runtime"],"analyzedSha":"0ae8c72462952df163f1b1e0726641bc5b40dc93","analyzedAt":"2026-08-06T19:44:29.143Z","schemaVersion":2},"datasetVersion":"2026-08-07T02:17:10.218Z"}