How to fix Error: HTTP/2 invalid settings frame (malformed settings) in Node.js

What this error means

The "HTTP/2 invalid settings frame (malformed settings)" error occurs when Node.js attempts to process HTTP/2 SETTINGS frames that violate the HTTP/2 specification (RFC 7540). A SETTINGS frame is used by HTTP/2 to exchange connection parameters between client and server. This error can arise from several protocol violations: - Settings parameters with unknown IDs - Parameter values outside valid ranges (e.g., max frame size < 16KB or > 24MB) - Incomplete or truncated SETTINGS frames - Incorrect frame length or structure - Server sending settings with deprecated or unsupported parameter combinations The error indicates that either the remote peer is sending malformed HTTP/2 data, or there's an issue with how the connection is being negotiated.

Typical symptoms

• HTTP/2 connection immediately closes with settings frame error
• Error message: "Error: HTTP/2 invalid settings frame (malformed settings)"
• Connection fails during HTTP/2 handshake
• GOAWAY frame received from server with protocol error
• Issue occurs with specific HTTP/2 servers or proxies
• Error in streams created after connection initialization
• Intermittent failures that depend on connection state
• Client connecting from Node.js while other clients work fine

Common causes

1. Server sends SETTINGS frame with invalid parameter ID (outside 0x0000-0x0006 range)
2. Settings parameter value exceeds maximum allowed (e.g., max frame size > 2^24-1 bytes)
3. Settings parameter value below minimum required (e.g., max frame size < 16KB)
4. HTTP/2 proxy or intermediary corrupts or incorrectly transforms SETTINGS frames
5. Server implementation bug in HTTP/2 stack sends malformed settings
6. TLS middlebox or network device interferes with HTTP/2 frames
7. Connection receives SETTINGS frame with incorrect octet length (not multiple of 6 bytes)
8. Initial connection window size set to value larger than max flow window size

How to fix "Error: HTTP/2 invalid settings frame (malformed settings)"

# On Linux/macOS
NODE_DEBUG=http2 node your-app.js

# On Windows (PowerShell)
$env:NODE_DEBUG='http2'
node your-app.js

# Using curl to test HTTP/2 server
curl -I --http2 https://example.com/

# Using h2spec to validate HTTP/2 compliance
go install github.com/summerwind/h2spec/v2@latest
h2spec -port 443 -tls example.com

# Try connecting directly to the origin IP (if accessible)
dig +short example.com  # Get the IP
curl -I --http2 --connect-to example.com:443:x.x.x.x:443 https://example.com/

# Or bypass proxies by connecting to the host directly
telnet example.com 443

# Check current version
node --version

# Update to the latest stable version (using nvm)
nvm install --latest-npm node
nvm use node

# Or update manually from https://nodejs.org/

const http2 = require('http2');

// Create HTTP/2 session with explicit settings
const session = http2.connect('https://example.com/', {
  settings: {
    headerTableSize: 4096,
    enablePush: false,
    initialWindowSize: 65535,
    maxFrameSize: 16384,  // Use minimum allowed value
    maxConcurrentStreams: 100,
    maxHeaderListSize: 8192
  }
});

session.on('error', (err) => {
  console.error('Session error:', err.message);
});

session.on('remoteSettings', (settings) => {
  console.log('Received settings from server:', settings);
});

const http2 = require('http2');

async function makeRequest() {
  return new Promise((resolve, reject) => {
    const session = http2.connect('https://example.com/');

    session.once('error', (err) => {
      console.error('HTTP/2 error:', err.message);

      // If it's a settings frame error, log details
      if (err.message.includes('settings frame')) {
        console.error('Server sent invalid HTTP/2 settings');
        console.error('Consider contacting the API provider');
      }

      reject(err);
    });

    const req = session.request({ ':path': '/api/data' });

    req.on('response', (headers) => {
      resolve(headers);
      session.close();
    });

    req.end();
  });
}

makeRequest().catch(err => {
  console.error('Request failed:', err.message);
});

I'm getting "HTTP/2 invalid settings frame (malformed settings)" when connecting
from Node.js v{version}. The connection fails immediately during the settings
negotiation phase. Testing with h2spec shows [list issues found]. Can you review
your HTTP/2 settings frame implementation against RFC 7540?

Advanced notes

# Capture HTTP/2 traffic
tcpdump -i eth0 -w http2.pcap 'tcp port 443'

# Or use mitmproxy to intercept and inspect HTTP/2
mitmproxy --mode reverse:https://example.com --http2 -p 8443

Frequently asked questions

What does "ERR_HTTP2_INVALID_SETTINGS_FRAME" mean?

js attempts to process HTTP/2 SETTINGS frames that violate the HTTP/2 specification (RFC 7540). A SETTINGS frame is used by HTTP/2 to exchange connection parameters between client and server. , max frame size < 16KB or > 24MB) - Incomplete or truncated SETTINGS frames - Incorrect frame length or structure - Server sending settings with deprecated or unsupported parameter combinations The error indicates that either the remote peer is sending malformed HTTP/2 data, or there's an issue with how the connection is being negotiated.

How do I fix "ERR_HTTP2_INVALID_SETTINGS_FRAME"?

This error occurs when Node.js HTTP/2 session receives a SETTINGS frame that does not comply with HTTP/2 protocol specifications. The settings frame may contain invalid parameter IDs, out-of-range values, or malformed data that the HTTP/2 parser cannot process.

What causes "ERR_HTTP2_INVALID_SETTINGS_FRAME"?

Server sends SETTINGS frame with invalid parameter ID (outside 0x0000-0x0006 range) Settings parameter value exceeds maximum allowed (e.g., max frame size > 2^24-1 bytes) Settings parameter value below minimum required (e.g., max frame size < 16KB)

Is the "ERR_HTTP2_INVALID_SETTINGS_FRAME" error serious?

It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Related errors

• Error: HTTP/2 stream closed (cannot send on closed stream)

  HTTP/2 stream closed error

  MEDIUM

• Error: HTTP/2 FRAME_SIZE_ERROR (frame payload exceeds limit)

  HTTP/2 frame size error in Node.js

  MEDIUM

• Error: Missing passphrase for encrypted private key (passphrase required)

  Missing passphrase for encrypted private key in Node.js HTTPS

  MEDIUM

• Error: HTTP/2 FLOW_CONTROL_ERROR (flow control protocol violation)

  HTTP/2 FLOW_CONTROL_ERROR protocol violation

  HIGH

• Error: zlib error Z_DATA_ERROR (corrupted compressed data)

  Z_DATA_ERROR: Corrupted compressed data

  MEDIUM

• Error: Could not find package.json in current directory (npm module resolution)

  How to fix "Could not find package.json in current directory" in Node.js

  MEDIUM

Official resources & further reading

• 📚Node.js Official Documentation