{"record":{"id":"9705cafe4088571e","repo":"FlowiseAI/Flowise","slug":"invalid-headers-too-many-entries-max-max-heade","errorCode":null,"errorMessage":"Invalid headers: too many entries (max ${MAX_HEADERS})","messagePattern":"Invalid headers: too many entries \\(max (.+?)\\)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/headerValidation.ts","lineNumber":46,"sourceCode":"\nconst MAX_HEADERS = 25\nconst MAX_KEY_LENGTH = 128\nconst MAX_VALUE_LENGTH = 2048\n\n/**\n * Validates a set of user-supplied HTTP headers intended for outbound requests.\n * Rejects malformed keys, CRLF/control-char injection in values, hop-by-hop and\n * sensitive header names, and oversized payloads. Throws a plain Error; callers\n * are responsible for mapping to their own error types.\n */\nexport function validateCustomHeaders(headers: Record<string, string>): void {\n    if (!headers || typeof headers !== 'object') {\n        throw new Error('Invalid headers: expected an object')\n    }\n\n    const entries = Object.entries(headers)\n    if (entries.length > MAX_HEADERS) {\n        throw new Error(`Invalid headers: too many entries (max ${MAX_HEADERS})`)\n    }\n\n    for (const [key, value] of entries) {\n        if (typeof key !== 'string' || key.length === 0) {\n            throw new Error('Invalid header: key must be a non-empty string')\n        }\n        if (key.length > MAX_KEY_LENGTH) {\n            throw new Error(`Invalid header \"${key}\": key exceeds ${MAX_KEY_LENGTH} chars`)\n        }\n        if (!RFC7230_TOKEN.test(key)) {\n            throw new Error(`Invalid header \"${key}\": key contains illegal characters`)\n        }\n\n        const lower = key.toLowerCase()\n        if (DENIED_HEADER_NAMES.has(lower) || DENIED_HEADER_PREFIXES.some((p) => lower.startsWith(p))) {\n            throw new Error(`Invalid header \"${key}\": this header name is not allowed`)\n        }\n","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/headerValidation.ts#L28-L64","documentation":"Enforces the MAX_HEADERS (25) cap to bound outbound request size and iteration cost. Throws when Object.entries(headers).length > 25.","triggerScenarios":"Caller supplies a header bag with more than 25 entries.","commonSituations":"Forwarding the full inbound request header bag downstream (including cookies, forwarded chains, sec-* headers) without filtering; bulk custom-header injection exceeding the cap; concatenating multiple header sources.","solutions":["Trim the header set to <=25 entries, keeping only the headers the downstream actually needs.","Filter out hop-by-hop, denied, and sensitive headers BEFORE counting toward the cap.","If you genuinely need more, raise MAX_HEADERS in the source (it is a module-level const) and document why."],"exampleFix":"// before\nvalidateCustomHeaders({ ...allInboundHeaders }) // 40 entries -> throws\n\n// after\nconst allowlisted = pick(allInboundHeaders, ['accept', 'content-type', 'trace-id'])\nvalidateCustomHeaders(allowlisted)","handlingStrategy":"validation","validationCode":"// Enforce the cap before calling validateCustomHeaders\nconst MAX_HEADERS = 25\nfunction trimToMax(headers, max = MAX_HEADERS) {\n    const entries = Object.entries(headers)\n    if (entries.length <= max) return headers\n    return Object.fromEntries(entries.slice(0, max))\n}","typeGuard":"function withinHeaderLimit(headers, max = 25) {\n    return Object.keys(headers).length <= max\n}","tryCatchPattern":"try {\n    validateCustomHeaders(headers)\n} catch (e) {\n    if (/too many entries/i.test(e.message)) headers = trimToMax(headers)\n    else throw e\n    validateCustomHeaders(headers)\n}","preventionTips":["Allowlist inbound headers before forwarding rather than passing the full bag.","Strip hop-by-hop, denied, and sensitive headers before counting toward the cap.","Surface the 25-entry limit in the node UI so users self-limit."],"tags":["headers","validation","limits","http"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}