{"record":{"id":"eea88d47e3a2b6ce","repo":"nats-io/nats-server","slug":"w-v1-line-too-long","errorCode":null,"errorMessage":"%w: v1 line too long","messagePattern":"%w: v1 line too long","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/client_proxyproto.go","lineNumber":168,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"failed to read v1 line: %w\", err)\n\t\t}\n\n\t\tline = buf[:len(line)+n]\n\n\t\t// Look for CRLF in what we've read so far\n\t\tfor i := 0; i < len(line)-1; i++ {\n\t\t\tif line[i] == '\\r' && line[i+1] == '\\n' {\n\t\t\t\t// Found CRLF - keep any over-read bytes for the client parser.\n\t\t\t\tremaining = append(remaining, line[i+2:]...)\n\t\t\t\tline = line[:i]\n\t\t\t\tgoto foundCRLF\n\t\t\t}\n\t\t}\n\t}\n\n\t// Exceeded max length without finding CRLF\n\treturn nil, nil, fmt.Errorf(\"%w: v1 line too long\", errProxyProtoInvalid)\n\nfoundCRLF:\n\t// Get parts from the protocol\n\tparts := strings.Fields(string(line))\n\n\t// Validate format\n\tif len(parts) < 1 {\n\t\treturn nil, nil, fmt.Errorf(\"%w: invalid v1 format\", errProxyProtoInvalid)\n\t}\n\n\t// Handle UNKNOWN (health check, like v2 LOCAL)\n\tif parts[0] == proxyProtoV1Unknown {\n\t\treturn nil, remaining, nil\n\t}\n\n\t// Must have exactly 5 parts: protocol, src-ip, dst-ip, src-port, dst-port\n\tif len(parts) != 5 {\n\t\treturn nil, nil, fmt.Errorf(\"%w: invalid v1 format\", errProxyProtoInvalid)","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/client_proxyproto.go#L150-L186","documentation":"The server detected that the PROXY protocol v1 header line exceeded the protocol maximum of 107 bytes (including CRLF) without encountering a terminating CRLF. Per the PROXY protocol spec, a v1 header must fit in 107 bytes, so a longer line means the sender is not a conforming proxy or the stream is corrupted. The server aborts the connection with an error wrapping errProxyProtoInvalid.","triggerScenarios":"A client connects to a PROXY-protocol-enabled listener and sends 'PROXY ' followed by more than 101 additional bytes (107 - 6 already read) without a '\\r\\n' terminator; e.g. a non-proxy client sending arbitrary text, or a proxy emitting a malformed over-long header.","commonSituations":"Misconfigured load balancer (HAProxy/nginx) sending non-standard headers; a plain NATS client accidentally pointed at a proxy-protocol port; a health-check or port scanner writing long garbage lines; corrupted TCP stream from a broken intermediary.","solutions":["Verify the upstream proxy actually emits conforming PROXY v1 headers (max 107 bytes ending in CRLF)","Check the load balancer's proxy-protocol configuration (e.g. HAProxy 'send-proxy' vs 'send-proxy-v2') and fix version mismatch","Ensure no non-PROXY-protocol clients are connecting directly to the proxy-protocol port","Capture the incoming bytes with tcpdump/ngrep to identify the offending sender"],"exampleFix":"// before: proxy sends oversized header\nPROXY TCP4 2001:0db8:85a3:0000:0000:8a2e:0370:7334-with-garbage-padding... (no CRLF within 107 bytes)\n// after: proxy emits conforming header\nPROXY TCP4 192.0.2.1 198.51.100.7 35646 4222\\r\\n","handlingStrategy":"validation","validationCode":"// Before emitting a PROXY v1 header from your proxy/client:\nheader := fmt.Sprintf(\"PROXY %s %s %s %d %d\\r\\n\", proto, srcIP, dstIP, srcPort, dstPort)\nif len(header) > 107 {\n    return errors.New(\"PROXY v1 header exceeds 107-byte limit\")\n}\nconn.Write([]byte(header))","typeGuard":"func isValidV1HeaderLine(line string) bool {\n    return len(line) <= 107 && strings.HasSuffix(line, \"\\r\\n\")\n}","tryCatchPattern":"addr, _, err := readProxyProtoHeader(conn)\nif err != nil {\n    if errors.Is(err, errProxyProtoInvalid) {\n        log.Printf(\"malformed PROXY header (line too long): %v\", err)\n        conn.Close() // drop non-conforming sender\n        return\n    }\n    return err\n}","preventionTips":["Keep v1 headers under 107 bytes including CRLF","Use PROXY v2 (binary, fixed signature) for dual-stack setups to avoid length edge cases","Monitor server logs for 'v1 line too long' to catch misbehaving senders early","Never point raw clients at a PROXY-protocol listener"],"tags":["proxy-protocol","network","tcp","nats"],"backgroundTag":"proxy-protocol-invalid-header","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}