# upstream sent invalid content-length while reading response header from upstream

- **ID:** `nginx/upstream-sent-invalid-content-length`
- **Domain:** nginx
- **Category:** protocol_error
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

Upstream server returned a Content-Length header with a negative or non-numeric value, violating HTTP protocol.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| nginx/1.24.0 | active | — | — |
| nginx/1.22.1 | active | — | — |
| nginx/1.26.0 | active | — | — |

## Workarounds

1. **Fix the upstream application to return a valid Content-Length header (e.g., in Python Flask: remove or set correct Content-Length via response.headers['Content-Length'] = str(len(data)))** (95% success)
   ```
   Fix the upstream application to return a valid Content-Length header (e.g., in Python Flask: remove or set correct Content-Length via response.headers['Content-Length'] = str(len(data)))
   ```
2. **Add proxy_ignore_headers Content-Length; in nginx config to ignore upstream's Content-Length if it is invalid (use with caution). Example: location / { proxy_pass http://backend; proxy_ignore_headers Content-Length; }** (80% success)
   ```
   Add proxy_ignore_headers Content-Length; in nginx config to ignore upstream's Content-Length if it is invalid (use with caution). Example: location / { proxy_pass http://backend; proxy_ignore_headers Content-Length; }
   ```
3. **Update upstream server code to not send Content-Length for chunked responses (e.g., in Node.js: res.removeHeader('Content-Length') before piping).** (85% success)
   ```
   Update upstream server code to not send Content-Length for chunked responses (e.g., in Node.js: res.removeHeader('Content-Length') before piping).
   ```

## Dead Ends

- **** — Buffer size does not affect header validity; the error is about malformed header value, not size. (70% fail)
- **** — Even without buffering, nginx parses response headers; the invalid Content-Length is still detected. (80% fail)
- **** — This controls request body size, not response header validation. (90% fail)