From a475247afb1150671fa114b5eb40c69b69b445d9 Mon Sep 17 00:00:00 2001
From: Tim Perry <pimterry@gmail.com>
Date: Wed, 17 Sep 2025 18:32:58 +0200
Subject: [PATCH] http2: add strictSingleValueFields option to relax header
 validation

Previously it was impossible to send multiple values for any header
or trailer defined officially as supporting only a single value.

This is a good default, but in practice many of these headers are used
in weird & wonderful ways where this can be problematic. This new
option allows for relaxing this restriction to support those cases
where required.

This option defaults to true so validation will still be applied
as before, rejecting multiple single-value fields, unless explicitly
disabled.
---
 doc/api/http2.md                              | 14 ++++
 lib/internal/http2/core.js                    | 58 ++++++++++++---
 lib/internal/http2/util.js                    | 29 +++++---
 lib/internal/quic/quic.js                     |  8 ++-
 ...ttp2-single-headers-validation-disabled.js | 53 ++++++++++++++
 ...> test-http2-single-headers-validation.js} |  0
 ...st-http2-util-assert-valid-pseudoheader.js | 18 ++---
 test/parallel/test-http2-util-headers-list.js | 72 ++++++++++++++-----
 8 files changed, 208 insertions(+), 44 deletions(-)
 create mode 100644 test/parallel/test-http2-single-headers-validation-disabled.js
 rename test/parallel/{test-http2-single-headers.js => test-http2-single-headers-validation.js} (100%)

diff --git a/doc/api/http2.md b/doc/api/http2.md
index 4663c7400b3730..19540a95a52a0d 100644
--- a/doc/api/http2.md
+++ b/doc/api/http2.md
@@ -2796,6 +2796,9 @@ Throws `ERR_INVALID_ARG_TYPE` for invalid `settings` argument.
 <!-- YAML
 added: v8.4.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/59917
+    description: Added the `strictSingleValueFields` option.
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/61713
     description: Added `http1Options` option. The `Http1IncomingMessage`
@@ -2955,6 +2958,10 @@ changes:
     and trailing whitespace validation for HTTP/2 header field names and values
     as per [RFC-9113](https://www.rfc-editor.org/rfc/rfc9113.html#section-8.2.1).
     **Default:** `true`.
+  * `strictSingleValueFields` {boolean} If `true`, strict validation is used
+    for headers and trailers defined as having only a single value, such that
+    an error is thrown if multiple values are provided.
+    **Default:** `true`.
   * `...options` {Object} Any [`net.createServer()`][] option can be provided.
 * `onRequestHandler` {Function} See [Compatibility API][]
 * Returns: {Http2Server}
@@ -3012,6 +3019,9 @@ server.listen(8000);
 <!-- YAML
 added: v8.4.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/59917
+    description: Added the `strictSingleValueFields` option.
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/61713
     description: Added `http1Options` option.
@@ -3133,6 +3143,10 @@ changes:
     and trailing whitespace validation for HTTP/2 header field names and values
     as per [RFC-9113](https://www.rfc-editor.org/rfc/rfc9113.html#section-8.2.1).
     **Default:** `true`.
+  * `strictSingleValueFields` {boolean} If `true`, strict validation is used
+    for headers and trailers defined as having only a single value, such that
+    an error is thrown if multiple values are provided.
+    **Default:** `true`.
   * `http1Options` {Object} An options object for configuring the HTTP/1
     fallback when `allowHTTP1` is `true`. These options are passed to the
     underlying HTTP/1 server. See [`http.createServer()`][] for available
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index 0b30abde1ea094..273ddd15414b51 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -136,6 +136,7 @@ const {
 const {
   assertIsObject,
   assertIsArray,
+  assertValidPseudoHeader,
   assertValidPseudoHeaderResponse,
   assertValidPseudoHeaderTrailer,
   assertWithinRange,
@@ -148,6 +149,7 @@ const {
   isPayloadMeaningless,
   kAuthority,
   kSensitiveHeaders,
+  kStrictSingleValueFields,
   kSocket,
   kRequest,
   kProtocol,
@@ -1318,6 +1320,8 @@ class Http2Session extends EventEmitter {
     this[kSocket] = socket;
     this[kTimeout] = null;
     this[kHandle] = undefined;
+    this[kStrictSingleValueFields] =
+      options.strictSingleValueFields;
 
     // Do not use nagle's algorithm
     if (typeof socket.setNoDelay === 'function')
@@ -2370,7 +2374,11 @@ class Http2Stream extends Duplex {
 
     this[kUpdateTimer]();
 
-    const headersList = buildNgHeaderString(headers, assertValidPseudoHeaderTrailer);
+    const headersList = buildNgHeaderString(
+      headers,
+      assertValidPseudoHeaderTrailer,
+      this.session[kStrictSingleValueFields],
+    );
     this[kSentTrailers] = headers;
 
     // Send the trailers in setImmediate so we don't do it on nghttp2 stack.
@@ -2579,7 +2587,11 @@ function prepareResponseHeaders(stream, headersParam, options) {
     stream[kSentHeaders] = headers;
   }
 
-  const headersList = buildNgHeaderString(headers, assertValidPseudoHeaderResponse);
+  const headersList = buildNgHeaderString(
+    headers,
+    assertValidPseudoHeaderResponse,
+    stream.session[kStrictSingleValueFields],
+  );
 
   return { headers, headersList, statusCode };
 }
@@ -2682,7 +2694,11 @@ function processRespondWithFD(self, fd, headers, offset = 0, length = -1,
 
   let headersList;
   try {
-    headersList = buildNgHeaderString(headers, assertValidPseudoHeaderResponse);
+    headersList = buildNgHeaderString(
+      headers,
+      assertValidPseudoHeaderResponse,
+      self.session[kStrictSingleValueFields],
+    );
   } catch (err) {
     if (self.ownsFd)
       tryClose(fd);
@@ -2909,7 +2925,11 @@ class ServerHttp2Stream extends Http2Stream {
     if (headers[HTTP2_HEADER_METHOD] === HTTP2_METHOD_HEAD)
       headRequest = options.endStream = true;
 
-    const headersList = buildNgHeaderString(headers);
+    const headersList = buildNgHeaderString(
+      headers,
+      assertValidPseudoHeader,
+      this.session[kStrictSingleValueFields],
+    );
 
     const streamOptions = options.endStream ? STREAM_OPTION_EMPTY_PAYLOAD : 0;
 
@@ -3173,7 +3193,11 @@ class ServerHttp2Stream extends Http2Stream {
 
     this[kUpdateTimer]();
 
-    const headersList = buildNgHeaderString(headers, assertValidPseudoHeaderResponse);
+    const headersList = buildNgHeaderString(
+      headers,
+      assertValidPseudoHeaderResponse,
+      this.session[kStrictSingleValueFields],
+    );
     if (!this[kInfoHeaders])
       this[kInfoHeaders] = [headers];
     else
@@ -3326,21 +3350,30 @@ function initializeOptions(options) {
   }
 
   if (options.maxSessionInvalidFrames !== undefined)
-    validateUint32(options.maxSessionInvalidFrames, 'maxSessionInvalidFrames');
+    validateUint32(options.maxSessionInvalidFrames, 'options.maxSessionInvalidFrames');
 
   if (options.maxSessionRejectedStreams !== undefined) {
     validateUint32(
       options.maxSessionRejectedStreams,
-      'maxSessionRejectedStreams',
+      'options.maxSessionRejectedStreams',
     );
   }
 
   if (options.unknownProtocolTimeout !== undefined)
-    validateUint32(options.unknownProtocolTimeout, 'unknownProtocolTimeout');
+    validateUint32(options.unknownProtocolTimeout, 'options.unknownProtocolTimeout');
   else
     // TODO(danbev): is this a good default value?
     options.unknownProtocolTimeout = 10000;
 
+  if (options.strictSingleValueFields !== undefined) {
+    validateBoolean(
+      options.strictSingleValueFields,
+      'options.strictSingleValueFields',
+    );
+  } else {
+    options.strictSingleValueFields = true;
+  }
+
 
   // Initialize http1Options bag for HTTP/1 fallback when allowHTTP1 is true.
   // This bag is passed to storeHTTPOptions() to configure HTTP/1 server
@@ -3553,6 +3586,15 @@ function connect(authority, options, listener) {
       throw new ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS();
   }
 
+  if (options.strictSingleValueFields !== undefined) {
+    validateBoolean(
+      options.strictSingleValueFields,
+      'options.strictSingleValueFields',
+    );
+  } else {
+    options.strictSingleValueFields = true;
+  }
+
   if (typeof authority === 'string')
     authority = new URL(authority);
 
diff --git a/lib/internal/http2/util.js b/lib/internal/http2/util.js
index ba981c8934dee9..25adc8f9697d82 100644
--- a/lib/internal/http2/util.js
+++ b/lib/internal/http2/util.js
@@ -39,6 +39,7 @@ const {
 
 const kAuthority = Symbol('authority');
 const kSensitiveHeaders = Symbol('sensitiveHeaders');
+const kStrictSingleValueFields = Symbol('strictSingleValueFields');
 const kSocket = Symbol('socket');
 const kProtocol = Symbol('protocol');
 const kProxySocket = Symbol('proxySocket');
@@ -121,7 +122,7 @@ const kValidPseudoHeaders = new SafeSet([
 
 // This set contains headers that are permitted to have only a single
 // value. Multiple instances must not be specified.
-const kSingleValueHeaders = new SafeSet([
+const kSingleValueFields = new SafeSet([
   HTTP2_HEADER_STATUS,
   HTTP2_HEADER_METHOD,
   HTTP2_HEADER_AUTHORITY,
@@ -690,6 +691,7 @@ function prepareRequestHeadersArray(headers, session) {
   const headersList = buildNgHeaderString(
     rawHeaders,
     assertValidPseudoHeader,
+    session[kStrictSingleValueFields],
   );
 
   return {
@@ -731,7 +733,11 @@ function prepareRequestHeadersObject(headers, session) {
       throw new ERR_HTTP2_CONNECT_PATH();
   }
 
-  const headersList = buildNgHeaderString(headersObject);
+  const headersList = buildNgHeaderString(
+    headersObject,
+    assertValidPseudoHeader,
+    session[kStrictSingleValueFields],
+  );
 
   return {
     headersObject,
@@ -751,10 +757,15 @@ const kNoHeaderFlags = StringFromCharCode(NGHTTP2_NV_FLAG_NONE);
  * format, rejecting illegal header configurations, and marking sensitive headers
  * that should not be indexed en route. This takes either a flat map of
  * raw headers ([k1, v1, k2, v2]) or a header object ({ k1: v1, k2: [v2, v3] }).
+ *
+ * Takes a validation function to check the pseudo-headers allowed for this
+ * message, and a boolean indicating whether to enforce strict single-value
+ * header validation.
  * @returns {[string, number]}
  */
 function buildNgHeaderString(arrayOrMap,
-                             assertValuePseudoHeader = assertValidPseudoHeader) {
+                             validatePseudoHeaderValue,
+                             strictSingleValueFields) {
   let headers = '';
   let pseudoHeaders = '';
   let count = 0;
@@ -765,7 +776,8 @@ function buildNgHeaderString(arrayOrMap,
 
   function processHeader(key, value) {
     key = key.toLowerCase();
-    const isSingleValueHeader = kSingleValueHeaders.has(key);
+    const isStrictSingleValueField = strictSingleValueFields &&
+      kSingleValueFields.has(key);
     let isArray = ArrayIsArray(value);
     if (isArray) {
       switch (value.length) {
@@ -776,13 +788,13 @@ function buildNgHeaderString(arrayOrMap,
           isArray = false;
           break;
         default:
-          if (isSingleValueHeader)
+          if (isStrictSingleValueField)
             throw new ERR_HTTP2_HEADER_SINGLE_VALUE(key);
       }
     } else {
       value = String(value);
     }
-    if (isSingleValueHeader) {
+    if (isStrictSingleValueField) {
       if (singles.has(key))
         throw new ERR_HTTP2_HEADER_SINGLE_VALUE(key);
       singles.add(key);
@@ -791,7 +803,7 @@ function buildNgHeaderString(arrayOrMap,
       kNeverIndexFlag :
       kNoHeaderFlags;
     if (key[0] === ':') {
-      const err = assertValuePseudoHeader(key);
+      const err = validatePseudoHeaderValue(key);
       if (err !== undefined)
         throw err;
       pseudoHeaders += `${key}\0${value}\0${flags}`;
@@ -893,7 +905,7 @@ function toHeaderObject(headers, sensitiveHeaders) {
     const existing = obj[name];
     if (existing === undefined) {
       obj[name] = name === HTTP2_HEADER_SET_COOKIE ? [value] : value;
-    } else if (!kSingleValueHeaders.has(name)) {
+    } else if (!kSingleValueFields.has(name)) {
       switch (name) {
         case HTTP2_HEADER_COOKIE:
           // https://tools.ietf.org/html/rfc7540#section-8.1.2.5
@@ -970,6 +982,7 @@ module.exports = {
   isPayloadMeaningless,
   kAuthority,
   kSensitiveHeaders,
+  kStrictSingleValueFields,
   kSocket,
   kProtocol,
   kProxySocket,
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index 459906d270dab6..026c0784f0bbe8 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -112,6 +112,7 @@ const {
 
 const {
   buildNgHeaderString,
+  assertValidPseudoHeader,
 } = require('internal/http2/util');
 
 const kEmptyObject = { __proto__: null };
@@ -887,8 +888,13 @@ class QuicStream {
     } else {
       debug(`stream ${this.id} sending headers`, headers);
     }
+    const headerString = buildNgHeaderString(
+      headers,
+      assertValidPseudoHeader,
+      true, // This could become an option in future
+    );
     // TODO(@jasnell): Support differentiating between early headers, primary headers, etc
-    return this.#handle.sendHeaders(1, buildNgHeaderString(headers), 1);
+    return this.#handle.sendHeaders(1, headerString, 1);
   }
 
   [kFinishClose](error) {
diff --git a/test/parallel/test-http2-single-headers-validation-disabled.js b/test/parallel/test-http2-single-headers-validation-disabled.js
new file mode 100644
index 00000000000000..4ea6da83673040
--- /dev/null
+++ b/test/parallel/test-http2-single-headers-validation-disabled.js
@@ -0,0 +1,53 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+
+const server = http2.createServer({
+  strictSingleValueFields: false
+});
+
+server.on('stream', common.mustCall((stream, _headers, _flags, rawHeaders) => {
+  assert.deepStrictEqual(rawHeaders.slice(8), [
+    'user-agent', 'abc',
+    'user-agent', 'xyz',
+    'referer', 'qwe',
+    'referer', 'asd',
+  ]);
+
+  stream.respond({
+    ':status': 200,
+    'expires': 'Thu, 01 Jan 1970 00:00:00 GMT',
+    'EXPIRES': 'Thu, 01 Jan 1970 00:00:00 GMT',
+    'content-type': ['a', 'b'],
+  });
+
+  stream.end();
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = http2.connect(`http://localhost:${server.address().port}`, {
+    strictSingleValueFields: false
+  });
+
+  const res = client.request({
+    'user-agent': 'abc',
+    'USER-AGENT': 'xyz',
+    'referer': ['qwe', 'asd'],
+  });
+
+  res.on('response', common.mustCall((_headers, _flags, rawHeaders) => {
+    assert.deepStrictEqual(rawHeaders.slice(2, 10), [
+      'expires', 'Thu, 01 Jan 1970 00:00:00 GMT',
+      'expires', 'Thu, 01 Jan 1970 00:00:00 GMT',
+      'content-type', 'a',
+      'content-type', 'b',
+    ]);
+
+    server.close();
+    client.close();
+  }));
+}));
diff --git a/test/parallel/test-http2-single-headers.js b/test/parallel/test-http2-single-headers-validation.js
similarity index 100%
rename from test/parallel/test-http2-single-headers.js
rename to test/parallel/test-http2-single-headers-validation.js
diff --git a/test/parallel/test-http2-util-assert-valid-pseudoheader.js b/test/parallel/test-http2-util-assert-valid-pseudoheader.js
index bd995f0338f106..29c41e7a5a83e9 100644
--- a/test/parallel/test-http2-util-assert-valid-pseudoheader.js
+++ b/test/parallel/test-http2-util-assert-valid-pseudoheader.js
@@ -4,20 +4,16 @@
 require('../common');
 const assert = require('assert');
 
-// Tests the assertValidPseudoHeader function that is used within the
-// buildNgHeaderString function. The assert function is not exported so we
-// have to test it through buildNgHeaderString
-
-const { buildNgHeaderString } = require('internal/http2/util');
+const { assertValidPseudoHeader } = require('internal/http2/util');
 
 // These should not throw
-buildNgHeaderString({ ':status': 'a' });
-buildNgHeaderString({ ':path': 'a' });
-buildNgHeaderString({ ':authority': 'a' });
-buildNgHeaderString({ ':scheme': 'a' });
-buildNgHeaderString({ ':method': 'a' });
+assertValidPseudoHeader(':status');
+assertValidPseudoHeader(':path');
+assertValidPseudoHeader(':authority');
+assertValidPseudoHeader(':scheme');
+assertValidPseudoHeader(':method');
 
-assert.throws(() => buildNgHeaderString({ ':foo': 'a' }), {
+assert.throws(() => assertValidPseudoHeader(':foo'), {
   code: 'ERR_HTTP2_INVALID_PSEUDOHEADER',
   name: 'TypeError',
   message: '":foo" is an invalid pseudoheader or is used incorrectly'
diff --git a/test/parallel/test-http2-util-headers-list.js b/test/parallel/test-http2-util-headers-list.js
index 0d1ac1d1b8c694..09135e865d4f98 100644
--- a/test/parallel/test-http2-util-headers-list.js
+++ b/test/parallel/test-http2-util-headers-list.js
@@ -9,6 +9,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 const assert = require('assert');
 const {
+  assertValidPseudoHeader,
   getAuthority,
   buildNgHeaderString,
   toHeaderObject
@@ -106,7 +107,7 @@ const {
   };
 
   assert.deepStrictEqual(
-    buildNgHeaderString(headers),
+    buildNgHeaderString(headers, assertValidPseudoHeader, true),
     [ [ ':path', 'abc\0', ':status', '200\0', 'abc', '1\0', 'xyz', '1\0',
         'xyz', '2\0', 'xyz', '3\0', 'xyz', '4\0', 'bar', '1\0', '' ].join('\0'),
       8 ]
@@ -123,7 +124,7 @@ const {
   };
 
   assert.deepStrictEqual(
-    buildNgHeaderString(headers),
+    buildNgHeaderString(headers, assertValidPseudoHeader, true),
     [ [ ':status', '200\0', ':path', 'abc\0', 'abc', '1\0', 'xyz', '1\0',
         'xyz', '2\0', 'xyz', '3\0', 'xyz', '4\0', '' ].join('\0'), 7 ]
   );
@@ -140,7 +141,7 @@ const {
   };
 
   assert.deepStrictEqual(
-    buildNgHeaderString(headers),
+    buildNgHeaderString(headers, assertValidPseudoHeader, true),
     [ [ ':status', '200\0', ':path', 'abc\0', 'abc', '1\0', 'xyz', '1\0',
         'xyz', '2\0', 'xyz', '3\0', 'xyz', '4\0', '' ].join('\0'), 7 ]
   );
@@ -156,7 +157,7 @@ const {
   headers[':path'] = 'abc';
 
   assert.deepStrictEqual(
-    buildNgHeaderString(headers),
+    buildNgHeaderString(headers, assertValidPseudoHeader, true),
     [ [ ':status', '200\0', ':path', 'abc\0', 'xyz', '1\0', 'xyz', '2\0',
         'xyz', '3\0', 'xyz', '4\0', '' ].join('\0'), 6 ]
   );
@@ -169,7 +170,7 @@ const {
     'set-cookie': ['foo=bar']
   };
   assert.deepStrictEqual(
-    buildNgHeaderString(headers),
+    buildNgHeaderString(headers, assertValidPseudoHeader, true),
     [ [ 'set-cookie', 'foo=bar\0', '' ].join('\0'), 1 ]
   );
 }
@@ -181,7 +182,7 @@ const {
     ':statuS': 204,
   };
 
-  assert.throws(() => buildNgHeaderString(headers), {
+  assert.throws(() => buildNgHeaderString(headers, assertValidPseudoHeader, true), {
     code: 'ERR_HTTP2_HEADER_SINGLE_VALUE',
     name: 'TypeError',
     message: 'Header field ":status" must only have a single value'
@@ -199,13 +200,14 @@ const {
   };
 
   assert.deepStrictEqual(
-    buildNgHeaderString(headers),
+    buildNgHeaderString(headers, assertValidPseudoHeader, true),
     [ ':status\x00200\x00\x00:path\x00abc\x00\x00abc\x001\x00\x00' +
       'xyz\x001\x00\x01xyz\x002\x00\x01xyz\x003\x00\x01xyz\x004\x00\x01', 7 ]
   );
 }
 
-// The following are not allowed to have multiple values
+// The following are not allowed to have multiple values by default, unless
+// strictSingleValueFields is set to false.
 [
   HTTP2_HEADER_STATUS,
   HTTP2_HEADER_METHOD,
@@ -248,10 +250,20 @@ const {
   HTTP2_HEADER_X_CONTENT_TYPE_OPTIONS,
 ].forEach((name) => {
   const msg = `Header field "${name}" must only have a single value`;
-  assert.throws(() => buildNgHeaderString({ [name]: [1, 2, 3] }), {
+  assert.throws(() => buildNgHeaderString(
+    { [name]: [1, 2, 3] },
+    assertValidPseudoHeader,
+    true
+  ), {
     code: 'ERR_HTTP2_HEADER_SINGLE_VALUE',
     message: msg
   });
+
+  assert(!(buildNgHeaderString(
+    { [name]: [1, 2, 3] },
+    assertValidPseudoHeader,
+    false
+  ) instanceof Error), name);
 });
 
 [
@@ -285,7 +297,11 @@ const {
   HTTP2_HEADER_WWW_AUTHENTICATE,
   HTTP2_HEADER_X_FRAME_OPTIONS,
 ].forEach((name) => {
-  assert(!(buildNgHeaderString({ [name]: [1, 2, 3] }) instanceof Error), name);
+  assert(!(buildNgHeaderString(
+    { [name]: [1, 2, 3] },
+    assertValidPseudoHeader,
+    true
+  ) instanceof Error), name);
 });
 
 [
@@ -304,7 +320,11 @@ const {
   'Proxy-Connection',
   'Keep-Alive',
 ].forEach((name) => {
-  assert.throws(() => buildNgHeaderString({ [name]: 'abc' }), {
+  assert.throws(() => buildNgHeaderString(
+    { [name]: 'abc' },
+    assertValidPseudoHeader,
+    true
+  ), {
     code: 'ERR_HTTP2_INVALID_CONNECTION_HEADERS',
     name: 'TypeError',
     message: 'HTTP/1 Connection specific headers are forbidden: ' +
@@ -312,7 +332,11 @@ const {
   });
 });
 
-assert.throws(() => buildNgHeaderString({ [HTTP2_HEADER_TE]: ['abc'] }), {
+assert.throws(() => buildNgHeaderString(
+  { [HTTP2_HEADER_TE]: ['abc'] },
+  assertValidPseudoHeader,
+  true
+), {
   code: 'ERR_HTTP2_INVALID_CONNECTION_HEADERS',
   name: 'TypeError',
   message: 'HTTP/1 Connection specific headers are forbidden: ' +
@@ -320,7 +344,11 @@ assert.throws(() => buildNgHeaderString({ [HTTP2_HEADER_TE]: ['abc'] }), {
 });
 
 assert.throws(
-  () => buildNgHeaderString({ [HTTP2_HEADER_TE]: ['abc', 'trailers'] }), {
+  () => buildNgHeaderString(
+    { [HTTP2_HEADER_TE]: ['abc', 'trailers'] },
+    assertValidPseudoHeader,
+    true
+  ), {
     code: 'ERR_HTTP2_INVALID_CONNECTION_HEADERS',
     name: 'TypeError',
     message: 'HTTP/1 Connection specific headers are forbidden: ' +
@@ -328,13 +356,25 @@ assert.throws(
   });
 
 // These should not throw
-buildNgHeaderString({ te: 'trailers' });
-buildNgHeaderString({ te: ['trailers'] });
+buildNgHeaderString(
+  { te: 'trailers' },
+  assertValidPseudoHeader,
+  true
+);
+buildNgHeaderString(
+  { te: ['trailers'] },
+  assertValidPseudoHeader,
+  true
+);
 
 // HTTP/2 encourages use of Host instead of :authority when converting
 // from HTTP/1 to HTTP/2, so we no longer disallow it.
 // Refs: https://github.com/nodejs/node/issues/29858
-buildNgHeaderString({ [HTTP2_HEADER_HOST]: 'abc' });
+buildNgHeaderString(
+  { [HTTP2_HEADER_HOST]: 'abc' },
+  assertValidPseudoHeader,
+  true
+);
 
 // If both are present, the latter has priority
 assert.strictEqual(getAuthority({