sveltejs/kit · error · Error

${env_prefix}XFF_DEPTH is ${xff_depth}, but only found ${add

Error message

${env_prefix}XFF_DEPTH is ${xff_depth}, but only found ${addresses.length} addresses

What it means

When ADDRESS_HEADER=x-forwarded-for, the adapter walks the comma-separated address list from the right XFF_DEPTH entries to find the original client. If XFF_DEPTH exceeds the number of addresses actually present, the configured trust depth cannot be satisfied and it throws to avoid returning a proxy's IP as the client.

Source

Thrown at packages/adapter-bun/src/handler.js:118

 * @returns {string}
 */
function get_client_address(request, bun_server) {
	if (!address_header) {
		// requestIP() is null over unix sockets; undefined matches adapter-node
		return /** @type {string} */ (bun_server.requestIP(request)?.address);
	}

	const value = request.headers.get(address_header);
	if (value === null) {
		throw new Error(
			`Address header was specified with ${env_prefix}ADDRESS_HEADER=${address_header} but is absent from request`
		);
	}
	if (address_header !== 'x-forwarded-for') return value;

	const addresses = value.split(',');
	if (xff_depth > addresses.length) {
		throw new Error(
			`${env_prefix}XFF_DEPTH is ${xff_depth}, but only found ${addresses.length} addresses`
		);
	}
	return addresses[addresses.length - xff_depth].trim();
}

View on GitHub (pinned to 03f1687fe6)

Solutions

Lower XFF_DEPTH to match the actual number of trusted proxy hops (usually 1).
Ensure all proxies in the chain append to X-Forwarded-For rather than overwriting it.
Make direct-to-server traffic (health probes) go through the proxy chain or exempt it.

Example fix

// env before
XFF_DEPTH=3   # only 1 proxy in front
// after
XFF_DEPTH=1

Defensive patterns

Strategy: validation

Validate before calling

const depth = Number(process.env.XFF_DEPTH || 1);
const count = (req.headers.get('x-forwarded-for') || '').split(',').filter(Boolean).length;
if (depth > count) console.warn(`XFF_DEPTH=${depth} but only ${count} addresses present`);

Try / catch

let ip;
try {
  ip = getClientAddress(event);
} catch (err) {
  if (/only found .* addresses/.test(err.message)) {
    ip = '0.0.0.0'; // fall back rather than trusting a proxy IP
  } else throw err;
}

Prevention

Set XFF_DEPTH to the true number of trusted proxy hops (usually 1).
Ensure each hop appends to X-Forwarded-For, never overwrites.
Route health checks through the same proxy chain or unset the header config for them.

When it happens

Trigger: XFF_DEPTH=2 (two proxy layers expected) but the request carries only one X-Forwarded-For entry; requests that reach the server without passing through all anticipated proxy layers.

Common situations: XFF_DEPTH tuned for production proxy chains but hit directly (health checks, local runs); clients that send their own single-entry X-Forwarded-For and a proxy that overwrites rather than appends.

Related errors

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/b37d7eccfe3febc1. Report an issue: GitHub.