René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"HTTP module does not allow sending all valid header values","articleBody":"### Version\n\nv25.5.0\n\n### Platform\n\n```text\nMicrosoft Windows NT 10.0.26200.0 x64\n```\n\n### Subsystem\n\nhttp\n\n### What steps will reproduce the bug?\n\n```js\nconst http = require(\"http\");\n\n// 0x01 is allowed per the Fetch spec (only 0x00, 0x0A, 0x0D are forbidden)\n// https://fetch.spec.whatwg.org/#header-value\nhttp.request({\n  hostname: \"localhost\",\n  port: 1,\n  headers: { \"X-Test\": \"\\x01\" }\n}); // throws ERR_INVALID_CHAR\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways\n\n### What is the expected behavior? Why is that the expected behavior?\n\nHeader value validation should be performed according to:\n\n- https://fetch.spec.whatwg.org/#header-value\n- https://httpwg.org/specs/rfc9110.html#fields.values\n\nThe latter gives a more restrictive ABNF, but per the change in https://github.com/httpwg/http-core/commit/f594c2f65becfff5cf505abdf493e7dcacf8ef00 relaxes the actual strict validation rules to\n\n\u003e a field value MUST either reject the message or replace each of those characters with SP before further processing or forwarding of that message. Field values containing other CTL characters are also invalid; however, recipients MAY retain such characters for the sake of robustness when they appear within a safe context (e.g., an application-specific quoted string that will not be processed by any downstream HTTP parser).\n\n### What do you see instead?\n\nERR_INVALID_CHAR\n\n### Additional information\n\nThis also affects undici/fetch, and prevents the following web platform test from passing:\n\nhttps://github.com/web-platform-tests/wpt/blob/master/fetch/api/headers/header-values.any.js\n\nBrowsers pass this; you can confirm with\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003cscript\u003e\nconst xhr = new XMLHttpRequest();\nxhr.open(\"GET\", \"/\");\nxhr.setRequestHeader(\"X-Test\", \"\\x01\");\nxhr.send();\n\nfetch(\"/\", { headers: { \"X-Test\": \"\\x01\" } });\n\u003c/script\u003e\n```\n\nand seeing that the headers do get sent over the network.\n\nIt would be fine if this functionality was off-by-default, but was in place for those wanting to write spec-compliant libraries (like jsdom).","author":{"url":"https://github.com/domenic","@type":"Person","name":"domenic"},"datePublished":"2026-01-30T03:58:36.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/61582/node/issues/61582"}