HTTP header size limits: nginx 400 and Node 431 errors, measured
There is no limit in the HTTP standard; each server sets its own. Here is where nginx and Node.js start refusing requests, and how to raise the limits.
1. Measured limits
| Server | Accepted | Refused | Error |
|---|---|---|---|
| nginx, default | one header of 8,180 bytes | one header of 8,191 bytes | 400 Request Header Or Cookie Too Large |
| nginx, default, several headers | 3 headers × 7,000 bytes | 5 headers × 7,000 bytes | same 400 |
nginx, large_client_header_buffers 4 32k | 32,000 bytes | 33,000 bytes | same 400 |
| Node.js 24, default | 16,300 bytes | 16,400 bytes | 431, empty body |
nginx's default (large_client_header_buffers 4 8k) means each header line, name and value included, must fit in 8 KB, and all of them together in four such buffers. Node counts all headers together against http.maxHeaderSize, which is 16,384 bytes.
2. Raising the limit
nginx (http or server block, then reload):
large_client_header_buffers 4 32k;Node.js, either for one server or for the whole process (both accepted a 40,000-byte header in our test):
http.createServer({ maxHeaderSize: 65536 }, handler);
node --max-http-header-size=65536 server.jsBehind a proxy or CDN, every hop has its own limit, so raise it on each one or the smallest one still wins.
3. Before raising it: why are the headers so big?
- Cookies are the usual cause: many tracking cookies, or a session stored entirely in a cookie. The error page names cookies for that reason. Clearing the site's cookies fixes it for one user; storing less in cookies fixes it for everyone (step-by-step fix for the cookie error).
- Large tokens: JWTs with many claims or embedded permissions. Check what's inside with the local JWT decoder.
- Headers added by a tool or extension: pause it and retry.
To see the request headers your browser sends, open DevTools → Network → the request → Headers. To try an oversized header on purpose, send one with curl: curl -H "X-Big: $(head -c 9000 /dev/zero | tr '\0' a)" -i https://your-site/.
Frequently asked questions
What is the maximum HTTP header size?
The HTTP standard sets none; servers do. In our tests nginx refused a single header line of about 8 KB by default, and Node.js refused more than 16 KB of headers in total.
How do I fix '400 Request Header Or Cookie Too Large' in nginx?
Users can clear the site's cookies. Server-side, raise large_client_header_buffers (e.g. 4 32k), and find out which cookie or header is so big.
What does HTTP 431 mean?
Request Header Fields Too Large. Node.js returns it when all request headers together exceed maxHeaderSize (16 KB by default).
Do browsers limit header size?
Servers almost always refuse first. We only measured the server side.
Written with AI assistance. Limits were measured on 2026-10-01 by sending growing headers to nginx:alpine 1.31.6 (default and 4 32k buffers) and a Node 24.21 http server (default, maxHeaderSize option and --max-http-header-size flag). PlainHeaders is our extension; the other methods are free.