hyperledger/fabric · error

inner channelheader is nil

Error message

inner channelheader is nil

What it means

verifyConfigUpdateMsg guard: the payload inside the config envelope's LastUpdate envelope has a nil ChannelHeader. The inner (last-update) message is structurally incomplete, so its type and channel cannot be checked.

Source

Thrown at orderer/consensus/smartbft/configverifier.go:206

	return nil
}

func (cbv *ConfigBlockValidator) verifyConfigUpdateMsg(outEnv *common.Envelope, confEnv *common.ConfigEnvelope, chdr *common.ChannelHeader) error {
	if confEnv == nil || confEnv.LastUpdate == nil || confEnv.Config == nil {
		return errors.New("invalid config envelope")
	}
	envPayload, err := protoutil.UnmarshalPayload(confEnv.LastUpdate.Payload)
	if err != nil {
		return err
	}

	if envPayload.Header == nil {
		return errors.New("inner header is nil")
	}

	if envPayload.Header.ChannelHeader == nil {
		return errors.New("inner channelheader is nil")
	}

	typ := common.HeaderType(chdr.Type)

	cbv.Logger.Infof("Applying filters for config update of type %s to channel %s", typ, chdr.ChannelId)

	// First apply the filters on the outer envelope, regardless of the type of transaction it is.
	if err := cbv.Filters.ApplyFilters(chdr.ChannelId, outEnv); err != nil {
		return err
	}

	var expectedConfigEnv *common.ConfigEnvelope
	channelID, err := protoutil.ChannelID(confEnv.LastUpdate)
	if err != nil {
		return errors.Errorf("error extracting channel ID from config update")
	}

	if cbv.ValidatingChannel != channelID {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Set envPayload.Header.ChannelHeader to a marshaled common.ChannelHeader with correct Type=CONFIG_UPDATE and ChannelId
2. Regenerate the envelope with an SDK's config-update builder
3. Validate the envelope client-side (protoutil-style checks) before submission

Example fix

// before
header := &common.Header{SignatureHeader: shdr}
// after
header := &common.Header{ChannelHeader: chdrBytes, SignatureHeader: shdr}

if envPayload.Header.ChannelHeader == nil {
    return errors.New("inner channel header is missing")
}

func hasChannelHeader(h *common.Header) bool {
    return h != nil && h.ChannelHeader != nil
}

When it happens

Trigger: envPayload.Header != nil but envPayload.Header.ChannelHeader == nil in verifyConfigUpdateMsg during ValidateConfig.

Common situations: Hand-built envelopes where only SignatureHeader was set; tooling that strips the ChannelHeader; deserialization issues that leave ChannelHeader bytes empty.

Related errors

• invalid config envelope
• inner header is nil
• error extracting channel ID from config update
• no channel header in payload
• consenter options type mismatch

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/ecf8b9c8828c5db5. Report an issue: GitHub.