{"record":{"id":"9fd0fea4193f306c","repo":"denoland/deno","slug":"err-invalid-arg-value-9fd0fe","errorCode":"ERR_INVALID_ARG_VALUE","errorMessage":"The property 'headers[http2.neverIndex]' is invalid. Received ${neverIndex}","messagePattern":"The property 'headers\\[http2\\.neverIndex\\]' is invalid\\. Received (.+?)","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/http2.ts","lineNumber":2785,"sourceCode":"  validatePreparedResponseHeaders(headers, statusCode);\n\n  return { headers, statusCode };\n}\n\nfunction validatePreparedResponseHeaders(headers, statusCode) {\n  // This is intentionally stricter than the HTTP/1 implementation, which\n  // allows values between 100 and 999 (inclusive) in order to allow for\n  // backwards compatibility with non-spec compliant code. With HTTP/2,\n  // we have the opportunity to start fresh with stricter spec compliance.\n  // This will have an impact on the compatibility layer for anyone using\n  // non-standard, non-compliant status codes.\n  if (statusCode < 200 || statusCode > 599) {\n    throw new ERR_HTTP2_STATUS_INVALID(statusCode);\n  }\n\n  const neverIndex = headers[kSensitiveHeaders];\n  if (neverIndex !== undefined && !ArrayIsArray(neverIndex)) {\n    throw new ERR_INVALID_ARG_VALUE(\"headers[http2.neverIndex]\", neverIndex);\n  }\n}\n\nfunction tryClose(fd) {\n  fs.close(fd, (err) => {\n    if (err) throw err;\n  });\n}\n\nfunction processRespondWithFD(\n  self,\n  fd,\n  headers,\n  offset = 0,\n  length = -1,\n  streamOptions = 0,\n) {\n  const state = self[kState];","sourceCodeStart":2767,"sourceCodeEnd":2803,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/http2.ts#L2767-L2803","documentation":"Response headers may carry a list of header names that must never be indexed in the HPACK dynamic table, attached with the http2.sensitiveHeaders symbol. validatePreparedResponseHeaders checks that headers[kSensitiveHeaders], if defined, is an Array; any other type throws ERR_INVALID_ARG_VALUE naming 'headers[http2.neverIndex]'.","triggerScenarios":"stream.respond({ ':status': 200, [http2.sensitiveHeaders]: 'authorization' }) — a bare string instead of an array; passing an object/Map of names; copy-paste from docs that dropped the array brackets.","commonSituations":"Marking Set-Cookie or Authorization as sensitive with a single name string because there is only one header; helpers that accept both a string and an array and forward whichever they got.","solutions":["Always pass an array of header names: [http2.sensitiveHeaders]: ['authorization']","Normalize string input to an array in helper code: names = Array.isArray(x) ? x : [x]","Leave the symbol off entirely when nothing is sensitive — undefined is allowed"],"exampleFix":"// before\nstream.respond({\n  ':status': 200,\n  [http2.sensitiveHeaders]: 'set-cookie', // string → throws\n});\n\n// after\nstream.respond({\n  ':status': 200,\n  [http2.sensitiveHeaders]: ['set-cookie'], // array of names\n});","handlingStrategy":"validation","validationCode":"const sensitive = rawSensitive === undefined\n  ? undefined\n  : Array.isArray(rawSensitive) ? rawSensitive : [rawSensitive];\nstream.respond({ ':status': 200, [http2.sensitiveHeaders]: sensitive });","typeGuard":"const isSensitiveHeadersList = (v: unknown): v is string[] =>\n  v === undefined || (Array.isArray(v) && v.every((n) => typeof n === 'string'));","tryCatchPattern":null,"preventionTips":["Always wrap sensitive header names in an array, even for a single name","Normalize helper inputs to arrays at the API boundary","Remember undefined is fine — omit the symbol when nothing is sensitive"],"tags":["http2","headers","hpack","argument-validation","node-compat"],"backgroundTag":"invalid-headers-argument","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}