valyala/fasthttp · error · ErrBrokenChunk

invalid character '\n' after chunk size

Error message

invalid character '\n' after chunk size

What it means

fasthttp rejects LF (newline) characters appearing in or right after the chunk-size line of a chunked body. Newlines in chunk extensions enable request smuggling through some reverse proxies, so the parser aborts with ErrBrokenChunk wrapping this security error.

Source

Thrown at http.go:2994

		c, err := r.ReadByte()
		if err != nil {
			return -1, ErrBrokenChunk{
				error: fmt.Errorf("cannot read '\\r' char at the end of chunk size: %w", err),
			}
		}
		if c == '\r' {
			if err := r.UnreadByte(); err != nil {
				return -1, ErrBrokenChunk{
					error: fmt.Errorf("cannot unread '\\r' char at the end of chunk size: %w", err),
				}
			}
			break
		}
		// Security: Don't allow newlines in chunk extensions.
		// This can lead to request smuggling issues with some reverse proxies.
		if c == '\n' {
			return -1, ErrBrokenChunk{
				error: errors.New("invalid character '\\n' after chunk size"),
			}
		}
		if inExt {
			continue
		}
		switch c {
		case ' ', '\t':
			afterSizeOWS = true
			continue
		case ';':
			if afterSizeOWS {
				return -1, ErrBrokenChunk{
					error: fmt.Errorf("invalid character %q after chunk size", c),
				}
			}
			inExt = true
			continue
		default:

View on GitHub (pinned to c96f600972)

Solutions

1. Fix the sender to use CRLF-terminated chunk lines and avoid newlines in chunk extensions.
2. If a proxy in front of fasthttp rewrites chunked bodies, upgrade/fix it to preserve proper framing.
3. Treat occurrences as potential smuggling attempts: log source and consider blocking the client.

Example fix

// before (invalid chunk-size line)
5;ext\r\n  or 5;ex\nt\r\n
// after (valid)
5;ext\r\nhello\r\n0\r\n\r\n

var broken fasthttp.ErrBrokenChunk
if errors.As(err, &broken) && strings.Contains(broken.Error(), "invalid character") {
    // log source IP, block client: likely smuggling attempt
    waf.Block(remoteAddr)
}

When it happens

Trigger: A chunk-size line contains a bare '\n' inside or after chunk extensions, e.g. "5;ext\n\r"; an attacker-crafted request/response attempting chunk-extension smuggling reaches the parser.

Common situations: Malicious clients probing for smuggling vectors; non-conformant servers sending LF-only line endings inside chunk extensions; security scans / fuzzers hitting the endpoint.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• too many transfer-encoding headers
• too large hex number
• fasthttp: extra whitespace in request line
• fasthttp: duplicate content-length header
• too many host headers

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/14d215b09231568e. Report an issue: GitHub.