sveltejs/kit · error · Error

The ${port_header} header specified ${port} which is an inva

Error message

The ${port_header} header specified ${port} which is an invalid port because it is not a number. The value should only contain the port number (e.g. 443)

What it means

If a PORT_HEADER (e.g. x-forwarded-port) is supplied, its value must be numeric so it can be appended to the origin as :port. A non-numeric value is rejected to prevent malformed origins and origin injection.

Source

Thrown at packages/adapter-node/src/handler.js:267

	if (protocol.includes(':')) {
		throw new Error(
			`The ${protocol_header} header specified ${protocol} which is an invalid because it includes \`:\`. It should only contain the protocol scheme (e.g. \`https\`)`
		);
	}

	const host =
		normalise_header(host_header, headers[host_header]) ||
		normalise_header('host', headers['host']);
	if (!host) {
		const header_names = host_header ? `${host_header} or host headers` : 'host header';
		throw new Error(
			`Could not determine host. The request must have a value provided by the ${header_names}`
		);
	}

	const port = normalise_header(port_header, headers[port_header]);
	if (port && isNaN(+port)) {
		throw new Error(
			`The ${port_header} header specified ${port} which is an invalid port because it is not a number. The value should only contain the port number (e.g. 443)`
		);
	}

	return port ? `${protocol}://${host}:${port}` : `${protocol}://${host}`;
}

export const handler = sequence(
	/** @type {(RequestHandler | Middleware)[]} */
	([serve(path.join(dir, 'client'), true), serve_prerendered(), ssr].filter(Boolean))
);

View on GitHub (pinned to 03f1687fe6)

Solutions

1. Fix the proxy so it sends a single numeric port, e.g. x-forwarded-port: 443
2. Change PORT_HEADER to a header only your trusted proxy sets
3. Strip/deduplicate the header value at the proxy layer

Example fix

// before
x-forwarded-port: https
// after
x-forwarded-port: 443

const port = req.headers['x-forwarded-port'];
if (typeof port === 'string' && isNaN(Number(port))) {
  throw new Error('x-forwarded-port must be numeric');
}

function isNumericPort(v) {
  return typeof v === 'string' && /^\d+$/.test(v);
}

try {
  origin = getOrigin(headers);
} catch (err) {
  if (String(err.message).includes('is not a number')) {
    console.error('Port header must be a single numeric value, e.g. 443');
  } else {
    throw err;
  }
}

When it happens

Trigger: A request arrives with the configured PORT_HEADER containing a non-numeric value (e.g. 'https', '443,80', or URL-encoded junk) and get_origin calls isNaN(+port).

Common situations: Proxies appending multiple port values, or clients injecting arbitrary header content when the port header is publicly settable.

Related errors

• Address header was specified with ${env_prefix + 'ADDRESS_HE
• ${env_prefix + 'XFF_DEPTH'} must be a positive integer
• ${env_prefix + 'XFF_DEPTH'} is ${xff_depth}, but only found
• Multiple values provided for ${name} header where only one e
• The ${protocol_header} header specified ${protocol} which is

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/4e2b22035b734631. Report an issue: GitHub.