{"record":{"id":"8cc204b98c031e24","repo":"nats-io/nats-server","slug":"invalid-proxy-protocol-header","errorCode":null,"errorMessage":"invalid PROXY protocol header","messagePattern":"invalid PROXY protocol header","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/client_proxyproto.go","lineNumber":74,"sourceCode":"\t// Header sizes\n\tproxyProtoV2HeaderSize = 16 // Fixed header: 12 (sig) + 1 (ver/cmd) + 1 (fam/proto) + 2 (addr len)\n\n\t// Timeout for reading PROXY protocol header\n\tproxyProtoReadTimeout = 5 * time.Second\n)\n\n// PROXY protocol v1 constants\nconst (\n\tproxyProtoV1Prefix     = \"PROXY \"\n\tproxyProtoV1MaxLineLen = 107 // Maximum line length including CRLF\n\tproxyProtoV1TCP4       = \"TCP4\"\n\tproxyProtoV1TCP6       = \"TCP6\"\n\tproxyProtoV1Unknown    = \"UNKNOWN\"\n)\n\nvar (\n\t// Errors\n\terrProxyProtoInvalid      = errors.New(\"invalid PROXY protocol header\")\n\terrProxyProtoUnsupported  = errors.New(\"unsupported PROXY protocol feature\")\n\terrProxyProtoTimeout      = errors.New(\"timeout reading PROXY protocol header\")\n\terrProxyProtoUnrecognized = errors.New(\"unrecognized PROXY protocol format\")\n)\n\n// proxyProtoAddr contains the address information extracted from PROXY protocol header\ntype proxyProtoAddr struct {\n\tsrcIP   net.IP\n\tsrcPort uint16\n\tdstIP   net.IP\n\tdstPort uint16\n}\n\n// String implements net.Addr interface\nfunc (p *proxyProtoAddr) String() string {\n\treturn net.JoinHostPort(p.srcIP.String(), fmt.Sprintf(\"%d\", p.srcPort))\n}\n","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/client_proxyproto.go#L56-L92","documentation":"Sentinel for malformed PROXY protocol input on a client connection; wrapped with context such as 'v1 line too long' or 'invalid v1 format' when the v1 text header cannot be parsed. Fires while reading the PROXY header when the peer sends data that is not a valid PROXY v1 header.","triggerScenarios":"Thrown at server/client_proxyproto.go:74 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the peer actually sends PROXY protocol v1/v2 (HAProxy-style)","Do not enable proxy protocol on a listener that receives direct client connections","Check the v1 line is under 107 bytes and CRLF-terminated"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}