valyala/fasthttp · error · ErrBrokenChunk

invalid character '\n' after chunk size

Error message

invalid character '\n' after chunk size

What it means

fasthttp rejects LF (newline) characters appearing in or right after the chunk-size line of a chunked body. Newlines in chunk extensions enable request smuggling through some reverse proxies, so the parser aborts with ErrBrokenChunk wrapping this security error.

Solutions

1. Fix the sender to use CRLF-terminated chunk lines and avoid newlines in chunk extensions.
2. If a proxy in front of fasthttp rewrites chunked bodies, upgrade/fix it to preserve proper framing.
3. Treat occurrences as potential smuggling attempts: log source and consider blocking the client.

Example fix

// before (invalid chunk-size line)
5;ext\r\n  or 5;ex\nt\r\n
// after (valid)
5;ext\r\nhello\r\n0\r\n\r\n

var broken fasthttp.ErrBrokenChunk
if errors.As(err, &broken) && strings.Contains(broken.Error(), "invalid character") {
    // log source IP, block client: likely smuggling attempt
    waf.Block(remoteAddr)
}

When it happens

Trigger: A chunk-size line contains a bare '\n' inside or after chunk extensions, e.g. "5;ext\n\r"; an attacker-crafted request/response attempting chunk-extension smuggling reaches the parser.

Common situations: Malicious clients probing for smuggling vectors; non-conformant servers sending LF-only line endings inside chunk extensions; security scans / fuzzers hitting the endpoint.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• too many transfer-encoding headers
• cannot find crlf at the end of chunk
• fasthttp: duplicate content-length header
• fasthttp: extra whitespace in request line
• invalid character after chunk size

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/14d215b09231568e. Report an issue: GitHub.

Appendix: source

Thrown at http.go:2994

		c, err := r.ReadByte()
		if err != nil {
			return -1, ErrBrokenChunk{
				error: fmt.Errorf("cannot read '\\r' char at the end of chunk size: %w", err),
			}
		}
		if c == '\r' {
			if err := r.UnreadByte(); err != nil {
				return -1, ErrBrokenChunk{
					error: fmt.Errorf("cannot unread '\\r' char at the end of chunk size: %w", err),
				}
			}
			break
		}
		// Security: Don't allow newlines in chunk extensions.
		// This can lead to request smuggling issues with some reverse proxies.
		if c == '\n' {
			return -1, ErrBrokenChunk{
				error: errors.New("invalid character '\\n' after chunk size"),
			}
		}
		if inExt {
			continue
		}
		switch c {
		case ' ', '\t':
			afterSizeOWS = true
			continue
		case ';':
			if afterSizeOWS {
				return -1, ErrBrokenChunk{
					error: fmt.Errorf("invalid character %q after chunk size", c),
				}
			}
			inExt = true
			continue
		default:

View on GitHub (pinned to c96f600972)