sveltejs/kit · error · Error

${env_prefix + 'XFF_DEPTH'} is ${xff_depth}, but only found

Error message

${env_prefix + 'XFF_DEPTH'} is ${xff_depth}, but only found ${addresses.length} addresses

What it means

When reading the client address from x-forwarded-for, XFF_DEPTH entries are counted from the right of the comma-separated list. If the header contains fewer addresses than XFF_DEPTH, the server cannot identify the real client and throws.

Source

Thrown at packages/adapter-node/src/handler.js:168

				if (!(address_header in req.headers)) {
					throw new Error(
						`Address header was specified with ${
							env_prefix + 'ADDRESS_HEADER'
						}=${address_header} but is absent from request`
					);
				}

				const value = /** @type {string} */ (req.headers[address_header]) || '';

				if (address_header === 'x-forwarded-for') {
					const addresses = value.split(',');

					if (xff_depth < 1) {
						throw new Error(`${env_prefix + 'XFF_DEPTH'} must be a positive integer`);
					}

					if (xff_depth > addresses.length) {
						throw new Error(
							`${env_prefix + 'XFF_DEPTH'} is ${xff_depth}, but only found ${
								addresses.length
							} addresses`
						);
					}
					return addresses[addresses.length - xff_depth].trim();
				}

				return value;
			}

			return (
				req.connection?.remoteAddress ||
				// @ts-expect-error
				req.connection?.socket?.remoteAddress ||
				req.socket?.remoteAddress ||
				// @ts-expect-error
				req.info?.remoteAddress

View on GitHub (pinned to 03f1687fe6)

Solutions

Lower XFF_DEPTH to a value less than or equal to the number of addresses your proxy chain always appends
Ensure all requests flow through the full proxy chain so x-forwarded-for has enough entries
Unset XFF_DEPTH (defaults to 1) if the topology is variable

Example fix

// before
XFF_DEPTH=3
// after
XFF_DEPTH=1

Defensive patterns

Strategy: fallback

Validate before calling

const depth = Number(process.env.XFF_DEPTH ?? 1);
const sample = req.headers['x-forwarded-for'] || '';
if (depth > sample.split(',').length) {
  console.warn('XFF_DEPTH exceeds number of x-forwarded-for entries for this path');
}

Type guard

null

Try / catch

try {
  const addr = getClientAddress();
} catch (err) {
  if (String(err.message).includes('but only found')) {
    console.error('Request bypassed some proxies; lower XFF_DEPTH or route through full chain');
  } else {
    throw err;
  }
}

Prevention

Ensure all traffic traverses the full proxy chain, including health checks
Match XFF_DEPTH to the minimum number of proxies every request passes
Test from staging/local networks where hop counts differ

When it happens

Trigger: A request arrives whose x-forwarded-for header has, say, 1 address, but XFF_DEPTH=2 (or higher), so indexing addresses[addresses.length - xff_depth] would be invalid.

Common situations: Increasing XFF_DEPTH to match one production proxy chain while local/staging requests bypass those proxies and carry fewer hops.

Related errors

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/a05c9a0be916a2eb. Report an issue: GitHub.