sveltejs/kit · error · Error

Multiple values provided for ${name} header where only one e

Error message

Multiple values provided for ${name} header where only one expected: ${value}

What it means

Some headers (protocol/host/port) must contain exactly one value to build the request origin. `normalise_header` accepts absent, empty, or single-valued headers, but throws when an HTTP/2-style or duplicated header arrives as an array with more than one value, since choosing one would be ambiguous and spoofable.

Source

Thrown at packages/adapter-node/src/handler.js:232

				return next();
			}
		}

		return handle(0);
	};
}

/**
 * @param {string} name
 * @param {string | string[] | undefined} value
 * @returns {string | undefined}
 */
function normalise_header(name, value) {
	if (!name) return undefined;
	if (Array.isArray(value)) {
		if (value.length === 0) return undefined;
		if (value.length === 1) return value[0];
		throw new Error(
			`Multiple values provided for ${name} header where only one expected: ${value}`
		);
	}
	return value;
}

/**
 * @param {IncomingHttpHeaders} headers
 * @returns {string}
 */
function get_origin(headers) {
	const protocol = decodeURIComponent(
		normalise_header(protocol_header, headers[protocol_header]) || 'https'
	);

	// this helps us avoid host injections through the protocol header
	if (protocol.includes(':')) {
		throw new Error(

View on GitHub (pinned to 03f1687fe6)

Solutions

Fix the proxy/gateway so it emits the header at most once per request
Choose a different header that is guaranteed single-valued
Intercept/dedupe the header at the proxy layer before it reaches the Node server

Example fix

// nginx: before
add_header x-forwarded-proto https;
add_header x-forwarded-proto https;
// after
add_header x-forwarded-proto https; # only once

Defensive patterns

Strategy: validation

Validate before calling

const v = req.headers['x-forwarded-proto'];
if (Array.isArray(v) && v.length > 1) {
  throw new Error('x-forwarded-proto sent multiple times; fix proxy config');
}

Type guard

function isSingleValue(v) {
  return !Array.isArray(v) || v.length <= 1;
}

Try / catch

try {
  origin = getOrigin(headers);
} catch (err) {
  if (String(err.message).includes('Multiple values provided')) {
    console.error('Proxy duplicates a trusted header; dedupe at the proxy layer');
  } else {
    throw err;
  }
}

Prevention

Audit proxy config for duplicate add_header/proxy_set_header lines
Prefer headers overwritten (not appended) by every proxy hop
Test with HTTP/2 clients where headers may arrive as arrays

When it happens

Trigger: A request contains the configured PROTOCOL_HEADER, HOST_HEADER, or PORT_HEADER with multiple comma/array entries (value.length > 1).

Common situations: Misconfigured proxies sending a header twice, or HTTP/2 pseudo-header conversions producing arrays instead of a single string.

Related errors

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/1fa481cd87ea36d3. Report an issue: GitHub.