{"record":{"id":"611d50904fdf90c4","repo":"nats-io/nats-server","slug":"processheaderpub-bad-or-missing-header-size-q","errorCode":null,"errorMessage":"processHeaderPub Bad or Missing Header Size: %q","messagePattern":"processHeaderPub Bad or Missing Header Size: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/client.go","lineNumber":2922,"sourceCode":"\tcase 3:\n\t\tc.pa.subject = args[0]\n\t\tc.pa.reply = nil\n\t\tc.pa.hdr = parseSize(args[1])\n\t\tc.pa.size = parseSize(args[2])\n\t\tc.pa.hdb = args[1]\n\t\tc.pa.szb = args[2]\n\tcase 4:\n\t\tc.pa.subject = args[0]\n\t\tc.pa.reply = args[1]\n\t\tc.pa.hdr = parseSize(args[2])\n\t\tc.pa.size = parseSize(args[3])\n\t\tc.pa.hdb = args[2]\n\t\tc.pa.szb = args[3]\n\tdefault:\n\t\treturn fmt.Errorf(\"processHeaderPub Parse Error: %q\", arg)\n\t}\n\tif c.pa.hdr < 0 {\n\t\treturn fmt.Errorf(\"processHeaderPub Bad or Missing Header Size: %q\", arg)\n\t}\n\t// If number overruns an int64, parseSize() will have returned a negative value\n\tif c.pa.size < 0 {\n\t\treturn fmt.Errorf(\"processHeaderPub Bad or Missing Total Size: %q\", arg)\n\t}\n\tif c.pa.hdr > c.pa.size {\n\t\treturn fmt.Errorf(\"processHeaderPub Header Size larger then TotalSize: %q\", arg)\n\t}\n\tmaxPayload := atomic.LoadInt32(&c.mpay)\n\t// Use int64() to avoid int32 overrun...\n\tif maxPayload != jwt.NoLimit && int64(c.pa.size) > int64(maxPayload) {\n\t\t// If we are given the remaining read buffer (since we do blind reads\n\t\t// we may have the beginning of the message header/payload), we will\n\t\t// look for the tracing header and if found, we will generate a\n\t\t// trace event with the max payload ingress error.\n\t\t// Do this only for CLIENT connections.\n\t\tif c.kind == CLIENT && c.pa.hdr > 0 && len(remaining) > 0 {\n\t\t\thdr := remaining[:min(len(remaining), c.pa.hdr)]","sourceCodeStart":2904,"sourceCodeEnd":2940,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/client.go#L2904-L2940","documentation":"NATS server failed to parse the header size field of an HMSG protocol message. parseSize() returned -1 (missing or non-numeric) or the field was absent, so the server cannot frame the header payload and closes the connection with this protocol error.","triggerScenarios":"Client sends `HMSG <subject> <reply> <hdr-size> <total-size>` with a missing, empty, or non-numeric header-size token (e.g. `HMSG foo  abc 10`), causing processHeaderPub to see c.pa.hdr < 0.","commonSituations":"Hand-rolled or buggy client protocol implementations, a client/library version mismatch producing malformed wire frames, corrupted frames from a broken TCP middlebox or proxy rewriting bytes.","solutions":["Fix the client to always emit a valid non-negative integer header size in HMSG before the total size","Upgrade or patch the client library so HMSG framing matches the NATS protocol spec","Check for proxies/middleboxes corrupting the TCP stream between client and server","Capture the wire traffic (or server log with debug enabled) to identify the offending client and its exact HMSG line"],"exampleFix":"// before (malformed frame)\nHMSG subject reply \n// after (valid frame: hdr=5, total=7)\nHMSG subject reply 5 7","handlingStrategy":"validation","validationCode":"func validHMSG(subject, reply string, hdr, total int) bool {\n    return hdr >= 0 && total >= 0 && hdr <= total && len(subject) > 0\n}","typeGuard":"func isNonNegativeSize(token string) (int64, bool) {\n    n, err := strconv.ParseInt(token, 10, 64)\n    return n, err == nil && n >= 0\n}","tryCatchPattern":null,"preventionTips":["Always emit HMSG as: subject [reply] hdrSize totalSize, with hdrSize a non-negative integer","Compute totalSize = hdrSize + len(payload) before writing the frame","Use a maintained NATS client library instead of hand-rolled protocol frames","Test frames against a local nats-server with debug logging enabled"],"tags":["protocol","parsing","nats"],"backgroundTag":"nats-protocol-parse-error","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}