How to fix Error: Parse Error (invalid HTTP response format) in Node.js

Node.jsINTERMEDIATEMEDIUMUpdated Dec 9, 2025· 201 views

This error occurs when Node.js HTTP client receives a malformed HTTP response that does not conform to the HTTP specification. The error happens at the socket parser level when headers or the status line are invalid, often due to strict validation in Node.js v12+.

Quick fix

Fixes HPE_INVALID_HEADER_TOKEN

const http = require('http');

const options = {
  hostname: 'api.example.com',
  port: 80,
  path: '/endpoint',
  method: 'GET',
  insecureHTTPParser: true  // Allow non-compliant responses
};

const req = http.request(options, (res) => {
  console.log('Status:', res.statusCode);
  res.on('data', (chunk) => {
    process.stdout.write(chunk);
  });
});

req.on('error', (e) => {
  console.error('Request error:', e.message);
});

req.end();
  1. Enable insecure HTTP parser for immediate workaround
  2. Use legacy HTTP parser via command line
  3. Use http-parser-js npm package
  4. Debug the response to find the problem
node.js — error
const http = require('http');
const options = {
  hostname: 'api.example.com',
  port: 80,
  path: '/endpoint',
  method: 'GET',
  insecureHTTPParser: true  // Allow non-compliant responses
};
const req = http.request(options, (res) => {
  console.log('Status:', res.statusCode);
  res.on('data', (chunk) => {
    process.stdout.write(chunk);
  });
});
req.on('error', (e) => {
  console.error('Request error:', e.message);
});
req.end();
Error: Parse Error (invalid HTTP response format)

What this error means

The "Parse Error" in Node.js HTTP parsing indicates that the incoming HTTP response does not conform to the HTTP specification. Node.js uses a strict HTTP parser that validates response headers and status lines. When the parser encounters invalid characters, malformed headers, or non-compliant HTTP format, it throws a parse error. This error is different from application-level errors—it occurs at the socket/protocol level before your code can even read the response. The HTTP parser rejects the response stream immediately, preventing the response event from firing. The error typically includes additional properties like `bytesParsed` (how many bytes were successfully parsed) and `code` (the specific parser error code like HPE_INVALID_HEADER_TOKEN, HPE_INVALID_CONSTANT, or HPE_UNEXPECTED_EOF). These errors often arise when servers don't follow strict HTTP compliance, which Node.js v12+ enforces more strictly than older versions.

Typical symptoms

  • Error at Socket.ondata with message "Parse Error"
  • Request fails immediately without response event firing
  • Error code shows HPE_INVALID_HEADER_TOKEN or similar parser error
  • Same API call works in browsers or with curl but fails in Node.js
  • bytesParsed property shows how much data was successfully parsed
  • Error started after upgrading Node.js to v12 or higher
  • HTTP requests to third-party APIs fail with parse errors
  • Server responses contain control characters in headers

Common causes

  1. Server sends invalid HTTP headers with non-compliant characters
  2. Response headers contain control characters or null bytes
  3. Multiple Content-Length headers or conflicting Content-Length and Transfer-Encoding
  4. HTTP status line is malformed or doesn't start with HTTP/
  5. Server includes body content with responses that should not have bodies (e.g., 204 No Content)
  6. Proxy or middleware adds invalid headers to the response
  7. Server uses anti-scraping protection that creates invalid HTTP responses
  8. Node.js HTTP parser stricter than browsers for spec compliance (v12+ change)

How to fix "Error: Parse Error (invalid HTTP response format)"

1Enable insecure HTTP parser for immediate workaround

If you need to connect to a non-compliant server immediately, enable the insecure parser at the request level:

javascript
const http = require('http');

const options = {
  hostname: 'api.example.com',
  port: 80,
  path: '/endpoint',
  method: 'GET',
  insecureHTTPParser: true  // Allow non-compliant responses
};

const req = http.request(options, (res) => {
  console.log('Status:', res.statusCode);
  res.on('data', (chunk) => {
    process.stdout.write(chunk);
  });
});

req.on('error', (e) => {
  console.error('Request error:', e.message);
});

req.end();

For HTTPS requests using the https module:

javascript
const https = require('https');

const options = {
  hostname: 'api.example.com',
  port: 443,
  path: '/endpoint',
  method: 'GET',
  insecureHTTPParser: true
};

https.request(options, (res) => {
  // Handle response
}).end();

Or via environment variable:

bash
NODE_OPTIONS="--insecure-http-parser" node app.js

Note: This is a temporary fix. The insecure parser opens your application to potential security vulnerabilities with malformed responses.

2Use legacy HTTP parser via command line

Node.js v12 introduced a new stricter HTTP parser. Use the legacy parser if you need immediate compatibility:

bash
# Run with legacy parser
node --http-parser=legacy app.js

Or set it via environment variable:

bash
NODE_OPTIONS="--http-parser=legacy" npm start

Or in .npmrc:

bash
node-options=--http-parser=legacy

For Docker:

dockerfile
FROM node:18-alpine

ENV NODE_OPTIONS="--http-parser=legacy"

WORKDIR /app
COPY . .
RUN npm install
CMD ["npm", "start"]

The legacy parser is more lenient with non-compliant responses but is still maintained for backward compatibility.

3Use http-parser-js npm package

The http-parser-js npm package provides a JavaScript-based HTTP parser that is more tolerant of non-compliant responses:

bash
npm install http-parser-js

Then enable it globally:

javascript
// At the very start of your app, before any HTTP requests
require('http-parser-js').monkeypatch();

// Now all HTTP requests will use the js parser
const http = require('http');
const https = require('https');

http.request(...);
https.request(...);

Or for specific libraries like axios:

javascript
require('http-parser-js').monkeypatch();

const axios = require('axios');

axios.get('https://api.example.com/endpoint')
  .then(response => {
    console.log('Success:', response.data);
  })
  .catch(error => {
    console.error('Error:', error.message);
  });

This is a good middle-ground solution that doesn't require rewriting your code but is more lenient than the strict parser.

4Debug the response to find the problem

Use a lower-level approach to capture the raw response and identify the invalid content:

javascript
const net = require('net');

// Connect directly to understand what the server is sending
const socket = net.createConnection({
  host: 'api.example.com',
  port: 80
});

socket.on('connect', () => {
  socket.write('GET /endpoint HTTP/1.1\r\nHost: api.example.com\r\n\r\n');
});

let rawData = '';
socket.on('data', (chunk) => {
  rawData += chunk.toString();
  console.log('Raw response (first 500 chars):');
  console.log(rawData.substring(0, 500));
  socket.destroy();
});

socket.on('error', (err) => {
  console.error('Socket error:', err);
});

Look for:
- Invalid characters in header names or values
- Missing colons in header format (Header: Value)
- Control characters (null bytes, etc.)
- Repeated headers
- Malformed status line (should be "HTTP/1.1 200 OK")

Once you identify the issue, you can either contact the API provider to fix their response or implement a workaround.

5Contact the API provider to fix their response

The most reliable long-term solution is to ensure the server sends compliant HTTP responses.

When reporting the issue, include:

javascript
const http = require('http');

const options = {
  hostname: 'api.example.com',
  port: 80,
  path: '/endpoint',
  method: 'GET'
};

const req = http.request(options, (res) => {
  console.log('Status:', res.statusCode);
});

req.on('error', (e) => {
  console.error('Error code:', e.code);
  console.error('Error message:', e.message);
  console.error('Bytes parsed:', e.bytesParsed);
  console.error('Raw packet (first bytes):', e.rawPacket?.toString('hex').substring(0, 100));
});

req.end();

Share these details with the server maintainer. Common issues they may fix:

- Invalid header characters: Remove control characters from headers
- Content-Length mismatch: Ensure Content-Length matches actual body size
- Duplicate headers: Remove redundant header definitions
- Invalid status line: Ensure responses start with "HTTP/1.1" format

6Implement response intercepting middleware

For libraries like axios or request, use middleware to clean up responses before parsing:

javascript
const axios = require('axios');

// Create an axios instance with custom error handling
const client = axios.create();

client.interceptors.response.use(
  (response) => response,
  (error) => {
    // Check if this is a parse error
    if (error.code === 'HPE_INVALID_HEADER_TOKEN' ||
        error.message.includes('Parse Error')) {

      console.warn('Parse error detected:', error.message);

      // Try alternative approach
      const fallbackUrl = error.config.url;
      console.log('Retrying with insecureHTTPParser...');

      // This requires modifying the underlying request
      // Consider using http-parser-js instead
    }

    return Promise.reject(error);
  }
);

client.get('https://api.example.com/endpoint')
  .catch(error => {
    console.error('Request failed:', error.message);
  });

For fetch API (Node.js 18+):

javascript
// Fetch doesn't have built-in parse error handling
// Use try-catch and inspect error details
try {
  const response = await fetch('https://api.example.com/endpoint');
  const data = await response.json();
  console.log(data);
} catch (error) {
  if (error.message.includes('Parse Error') ||
      error.message.includes('invalid')) {
    console.error('Server sent invalid response:', error.message);
  }
}

Advanced notes

Understanding HTTP Parser Changes in Node.js v12

Node.js v12 replaced the C-based http_parser with llhttp, a stricter HTTP parser. This improved security and spec compliance but broke compatibility with non-compliant servers.

If your code worked in Node.js v11 but fails in v12+, this is likely the cause. The legacy parser (--http-parser=legacy) provides backward compatibility during the transition.

Common Non-Compliant Patterns

1. Control Characters in Headers: Some servers inadvertently include null bytes or other control characters. The strict parser rejects these immediately.

2. Content-Length Issues:

bash
HTTP/1.1 200 OK
Content-Length: 100
Transfer-Encoding: chunked

This violates HTTP spec—only one should be present

3. Invalid Header Format:

bash
HTTP/1.1 200 OK
Header-Without-Colon Value  // Invalid!
Valid-Header: Value

Anti-Scraping Detection

Some websites intentionally send malformed responses to block automated requests. If you're getting parse errors from a website you don't control, consider:

- Setting a User-Agent header to look like a browser
- Using puppeteer or playwright for JavaScript rendering
- Respecting robots.txt and rate limits
- Contacting the website for API access

Debugging with tcpdump or Wireshark

For serious debugging, capture the raw traffic:

bash
# Capture all traffic on port 80 to a file
tcpdump -i any -A 'tcp port 80' -w capture.pcap

# View captured packets
tcpdump -A -r capture.pcap | head -100

This shows exactly what bytes the server is sending, helping identify the invalid content.

Error Properties

Parse errors include useful debugging information:

javascript
req.on('error', (err) => {
  console.error('Code:', err.code);           // HPE_INVALID_HEADER_TOKEN, etc.
  console.error('Message:', err.message);     // Human readable
  console.error('Bytes parsed:', err.bytesParsed);  // How far parser got
  console.error('Raw packet hex:', err.rawPacket?.toString('hex'));  // First bytes
});

The bytesParsed tells you roughly where the invalid content starts, helping pinpoint the issue.

Frequently asked questions

What does "HPE_INVALID_HEADER_TOKEN" mean?
js HTTP parsing indicates that the incoming HTTP response does not conform to the HTTP specification. js uses a strict HTTP parser that validates response headers and status lines. When the parser encounters invalid characters, malformed headers, or non-compliant HTTP format, it throws a parse error.
How do I fix "HPE_INVALID_HEADER_TOKEN"?
This error occurs when Node.js HTTP client receives a malformed HTTP response that does not conform to the HTTP specification. The error happens at the socket parser level when headers or the status line are invalid, often due to strict validation in Node.js v12+.
What causes "HPE_INVALID_HEADER_TOKEN"?
Server sends invalid HTTP headers with non-compliant characters Response headers contain control characters or null bytes Multiple Content-Length headers or conflicting Content-Length and Transfer-Encoding
Is the "HPE_INVALID_HEADER_TOKEN" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading