valyala/fasthttp · error

too many host headers

Error message

too many host headers

What it means

HTTP semantics allow only one Host header per request. fasthttp enforces this: while parsing headers, if a second Host header is seen it marks the connection close and returns this error. Duplicate Host headers are also a smuggling/confusion vector.

Source

Thrown at header.go:3243

						return 0, ErrUnsupportedTransferEncoding
					}
					return 0, errors.New("too many transfer-encoding headers")
				}
				transferEncodingSeen = true
			}
		}

		if h.disableSpecialHeader {
			h.h = appendArgBytes(h.h, s.key, s.value, argsHasValue)
			continue
		}

		switch s.key[0] | 0x20 {
		case 'h':
			if caseInsensitiveCompare(s.key, strHost) {
				if hostSeen {
					h.connectionClose = true
					return 0, errors.New("too many host headers")
				}
				hostSeen = true
				h.host = append(h.host[:0], s.value...)
				continue
			}
		case 'u':
			if caseInsensitiveCompare(s.key, strUserAgent) {
				h.userAgent = append(h.userAgent[:0], s.value...)
				continue
			}
		case 'c':
			if caseInsensitiveCompare(s.key, strContentType) {
				h.contentType = append(h.contentType[:0], s.value...)
				continue
			}
			if isContentLength {
				if h.contentLength != -1 {
					h.contentLength = contentLength

View on GitHub (pinned to c96f600972)

Solutions

1. Fix the client to set Host once (fasthttp sets it from URI automatically; don't Add Host manually).
2. Normalize requests at the edge proxy (strip duplicate Host before forwarding).
3. Reject/monitor the offending sender; fasthttp already closes the connection.
4. If generating requests in tests/tools, build URIs with a single host instead of a manual Host header.

Example fix

// before
req.Header.Add("Host", "a.example.com")
req.Header.Add("Host", "b.example.com")
// after
req.SetHost("a.example.com") // or let req.SetRequestURI("http://a.example.com/") set it

func hasSingleHost(h map[string][]string) bool {
    return len(h["Host"]) <= 1
}

When it happens

Trigger: Parsing a request (or message) with two or more Host headers at header.go:3243 in the header scan switch.

Common situations: Hand-crafted or malicious requests; buggy HTTP clients that append Host via Add instead of Set; proxies that insert a Host without removing the client's.

Related errors

• fasthttp: duplicate content-length header
• too many transfer-encoding headers
• fasthttp: extra whitespace in request line
• fasthttp: unsupported transfer-encoding
• fasthttp: non-numeric chars found

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/d6b21f4de67ff09b. Report an issue: GitHub.