fix: reject duplicate content-length and host headers

mcollina · mcollina · commit 4e0179ae643e · 2026-03-12T14:49:47.000+01:00
When headers are passed as an array, reject duplicate content-length and host headers regardless of casing. This prevents malformed HTTP/1.1 requests with multiple Content-Length values from being sent on the wire. Previously, case-variant duplicates (e.g., 'Content-Length' and 'content-length') would bypass the duplicate check, resulting in ambiguous HTTP requests that could be interpreted inconsistently by proxies and backends. Signed-off-by: Matteo Collina <hello@matteocollina.com> (cherry picked from commit 74495c6)
diff --git a/lib/core/request.js b/lib/core/request.js
@@ -364,13 +364,19 @@ function processHeader (request, key, val) {
     val = `${val}`
   }
 
-  if (request.host === null && headerName === 'host') {
+  if (headerName === 'host') {
+    if (request.host !== null) {
+      throw new InvalidArgumentError('duplicate host header')
+    }
     if (typeof val !== 'string') {
       throw new InvalidArgumentError('invalid host header')
     }
     // Consumed by Client
     request.host = val
-  } else if (request.contentLength === null && headerName === 'content-length') {
+  } else if (headerName === 'content-length') {
+    if (request.contentLength !== null) {
+      throw new InvalidArgumentError('duplicate content-length header')
+    }
     request.contentLength = parseInt(val, 10)
     if (!Number.isFinite(request.contentLength)) {
       throw new InvalidArgumentError('invalid content-length header')
diff --git a/test/headers-as-array.js b/test/headers-as-array.js
@@ -153,3 +153,97 @@ test('fail if headers is not an object or an array', async (t) => {
 
   await t.completed
 })
+
+test('fail if duplicate content-length headers (different case)', async (t) => {
+  t = tspl(t, { plan: 2 })
+  const headers = ['Content-Length', '5', 'content-length', '0']
+
+  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => { res.end() })
+  after(() => server.close())
+  server.listen(0, () => {
+    const client = new Client(`http://localhost:${server.address().port}`)
+    after(() => client.close())
+
+    client.request({
+      path: '/',
+      method: 'POST',
+      headers,
+      body: 'hello'
+    }, (err) => {
+      t.ok(err instanceof errors.InvalidArgumentError)
+      t.strictEqual(err.message, 'duplicate content-length header')
+    })
+  })
+
+  await t.completed
+})
+
+test('fail if duplicate content-length headers (same case)', async (t) => {
+  t = tspl(t, { plan: 2 })
+  const headers = ['content-length', '5', 'content-length', '0']
+
+  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => { res.end() })
+  after(() => server.close())
+  server.listen(0, () => {
+    const client = new Client(`http://localhost:${server.address().port}`)
+    after(() => client.close())
+
+    client.request({
+      path: '/',
+      method: 'POST',
+      headers,
+      body: 'hello'
+    }, (err) => {
+      t.ok(err instanceof errors.InvalidArgumentError)
+      t.strictEqual(err.message, 'duplicate content-length header')
+    })
+  })
+
+  await t.completed
+})
+
+test('fail if duplicate host headers (different case)', async (t) => {
+  t = tspl(t, { plan: 2 })
+  const headers = ['Host', 'example.com', 'host', 'evil.com']
+
+  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => { res.end() })
+  after(() => server.close())
+  server.listen(0, () => {
+    const client = new Client(`http://localhost:${server.address().port}`)
+    after(() => client.close())
+
+    client.request({
+      path: '/',
+      method: 'GET',
+      headers
+    }, (err) => {
+      t.ok(err instanceof errors.InvalidArgumentError)
+      t.strictEqual(err.message, 'duplicate host header')
+    })
+  })
+
+  await t.completed
+})
+
+test('fail if duplicate host headers (same case)', async (t) => {
+  t = tspl(t, { plan: 2 })
+  const headers = ['host', 'example.com', 'host', 'evil.com']
+
+  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => { res.end() })
+  after(() => server.close())
+  server.listen(0, () => {
+    const client = new Client(`http://localhost:${server.address().port}`)
+    after(() => client.close())
+
+    client.request({
+      path: '/',
+      method: 'GET',
+      headers
+    }, (err) => {
+      t.ok(err instanceof errors.InvalidArgumentError)
+      t.strictEqual(err.message, 'duplicate host header')
+    })
+  })
+
+  await t.completed
+})
