denoland/deno · error · TypeError

Invalid header value: "${value}"

Error message

Invalid header value: "${value}"

What it means

appendHeader rejects values containing \n (0x0A), \r (0x0D), or \0 (0x00) after trimming (checkForInvalidValueChars). This blocks header and request splitting through values.

Source

Thrown at ext/fetch/20_headers.js:176

  return valid;
}

/**
 * https://fetch.spec.whatwg.org/#concept-headers-append
 * @param {Headers} headers
 * @param {string} name
 * @param {string} value
 */
function appendHeader(headers, name, value) {
  // 1.
  value = normalizeHeaderValue(value);

  // 2.
  if (!checkHeaderNameForHttpTokenCodePoint(name)) {
    throw new TypeError(`Invalid header name: "${name}"`);
  }
  if (!checkForInvalidValueChars(value)) {
    throw new TypeError(`Invalid header value: "${value}"`);
  }

  // 3.
  if (headers[_guard] == "immutable") {
    throw new TypeError("Cannot change header: headers are immutable");
  }

  // 7.
  const list = headerListFromHeaders(headers);
  const lowerNames = ensureLowerNames(headers);
  const lowercaseName = byteLowerCase(name);
  for (let i = 0; i < lowerNames.length; i++) {
    if (lowerNames[i] === lowercaseName) {
      name = list[i][0];
      break;
    }
  }
  ArrayPrototypePush(list, [name, value]);

View on GitHub (pinned to 89f33cbef2)

Solutions

1. Strip or replace the characters: value.replace(/[\r\n\0]/g, ' ').
2. Move multi-line content into the body, or encode it (base64, encodeURIComponent).

Example fix

// before
headers.set('x-log', logLines.join('\n'));
// after
headers.set('x-log', encodeURIComponent(logLines.join('\n')));

const safeValue = value.replace(/[\r\n\0]/g, ' ');
headers.set(name, safeValue);

function isValidHeaderValue(value: string): boolean {
  return ![\r, \n, '\0'].some((c) => value.includes(c));
}

try {
  headers.set(name, value);
} catch (e) {
  if (e instanceof TypeError && /Invalid header value/.test(e.message)) {
    headers.set(name, encodeURIComponent(value));
  } else {
    throw e;
  }
}

When it happens

Trigger: headers.set('x', 'a\nb: c'); values joined from multi-line text with \n or \r; values containing NUL bytes from binary data coerced to strings.

Common situations: Multi-line descriptions, CSV, or logs written into a header; unsanitized user input in header values.

Related errors

• Invalid header name: "${name}"
• ERR_INVALID_CHAR
• Invalid header: length must be 2, but is ${header.length}
• Cannot change header: headers are immutable
• Cannot change headers: headers are immutable

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/ab08ae6029dd70da. Report an issue: GitHub.