araujogui · Nov 3, 2026
diff --git a/benchmark/http/set-header-rest.js b/benchmark/http/set-header-rest.js
@@ -0,0 +1,50 @@
+'use strict';
+
+const common = require('../common.js');
+const http = require('http');
+
+const bench = common.createBenchmark(main, {
+  headers: [2, 12],
+  values: ['static', 'dynamic'],
+  duration: 5,
+});
+
+const restHeaders = [
+  ['Content-Type', 'application/json; charset=utf-8'],
+  ['Cache-Control', 'no-store'],
+  ['X-Content-Type-Options', 'nosniff'],
+  ['X-Frame-Options', 'DENY'],
+  ['Strict-Transport-Security', 'max-age=31536000; includeSubDomains'],
+  ['Access-Control-Allow-Origin', '*'],
+  ['Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE'],
+  ['Vary', 'Origin, Accept-Encoding'],
+  ['X-RateLimit-Limit', '1000'],
+  ['X-RateLimit-Remaining', '999'],
+  ['ETag', 'W/"2a-abc"'],
+  ['X-Request-Id', '00000000'],
+];
+
+function main({ headers, values, duration }) {
+  const list = restHeaders.slice(0, headers);
+  const body = '{"ok":true}';
+  let id = 0;
+
+  const server = http.createServer((req, res) => {
+    for (const { 0: name, 1: value } of list) {
+      res.setHeader(name, values === 'dynamic' ? `${value}-${id}` : value);
+    }
+    id++;
+    res.end(body);
+  });
+
+  server.listen(0, () => {
+    bench.http({
+      path: '/',
+      connections: 100,
+      duration,
+      port: server.address().port,
+    }, () => {
+      server.close();
+    });
+  });
+}
diff --git a/lib/internal/http/outgoing.js b/lib/internal/http/outgoing.js
@@ -29,6 +29,7 @@ const {
   ObjectKeys,
   ObjectSetPrototypeOf,
   ObjectValues,
+  SafeMap,
   SafeSet,
   Symbol,
 } = primordials;
@@ -752,6 +753,54 @@ const validateHeaderName = assignFunctionName('validateHeaderName', hideStackFra
   }
 }));
 
+// Only strings are cached: arrays are mutable and must be re-validated.
+const kMaxCachedHeaderNames = 256;
+const kMaxCachedHeaderValueLength = 256;
+const validatedHeaders = new SafeMap();
+
+class ValidatedHeader {
+  constructor(name) {
+    this.lowerCaseName = name.toLowerCase();
+    this.lastStrictValue = undefined;
+    this.lastLenientValue = undefined;
+  }
+}
+
+function validateHeaderNameCached(name) {
+  let header = validatedHeaders.get(name);
+  if (header !== undefined) return header;
+
+  if (!isValidHeaderName(name)) {
+    throw new ERR_INVALID_HTTP_TOKEN.HideStackFramesError('Header name', name);
+  }
+  header = new ValidatedHeader(name);
+  if (validatedHeaders.size < kMaxCachedHeaderNames) {
+    validatedHeaders.set(name, header);
+  }
+  return header;
+}
+
+function validateHeaderValueCached(msg, header, name, value) {
+  if (value === undefined) {
+    throw new ERR_HTTP_INVALID_HEADER_VALUE(value, name);
+  }
+  const lenient = msg._isLenientHeaderValidation();
+  const lastValid = lenient ? header.lastLenientValue : header.lastStrictValue;
+  if (value === lastValid) return;
+
+  if (checkInvalidHeaderChar(value, lenient)) {
+    debug('Header "%s" contains invalid characters', name);
+    throw new ERR_INVALID_CHAR('header content', name);
+  }
+  if (typeof value !== 'string' || value.length > kMaxCachedHeaderValueLength) return;
+
+  if (lenient) {
+    header.lastLenientValue = value;
+  } else {
+    header.lastStrictValue = value;
+  }
+}
+
 /**
  * Non-throwing counterpart of `validateHeaderName()`.
  * @param {any} name
@@ -814,20 +863,14 @@ OutgoingMessage.prototype.setHeader = function setHeader(name, value) {
   if (this._header) {
     throw new ERR_HTTP_HEADERS_SENT('set');
   }
-  validateHeaderName(name);
-  if (value === undefined) {
-    throw new ERR_HTTP_INVALID_HEADER_VALUE(value, name);
-  }
-  if (checkInvalidHeaderChar(value, this._isLenientHeaderValidation())) {
-    debug('Header "%s" contains invalid characters', name);
-    throw new ERR_INVALID_CHAR('header content', name);
-  }
+  const header = validateHeaderNameCached(name);
+  validateHeaderValueCached(this, header, name, value);
 
   let headers = this[kOutHeaders];
   if (headers === null)
     this[kOutHeaders] = headers = new OutgoingHeaders();
 
-  headers[name.toLowerCase()] = [name, value];
+  headers[header.lowerCaseName] = [name, value];
   return this;
 };
 
@@ -878,16 +921,10 @@ OutgoingMessage.prototype.appendHeader = function appendHeader(name, value) {
   if (this._header) {
     throw new ERR_HTTP_HEADERS_SENT('append');
   }
-  validateHeaderName(name);
-  if (value === undefined) {
-    throw new ERR_HTTP_INVALID_HEADER_VALUE(value, name);
-  }
-  if (checkInvalidHeaderChar(value, this._isLenientHeaderValidation())) {
-    debug('Header "%s" contains invalid characters', name);
-    throw new ERR_INVALID_CHAR('header content', name);
-  }
+  const header = validateHeaderNameCached(name);
+  validateHeaderValueCached(this, header, name, value);
+  const field = header.lowerCaseName;
 
-  const field = name.toLowerCase();
   const headers = this[kOutHeaders];
   if (headers === null || !headers[field]) {
     return this.setHeader(name, value);

diff --git a/test/parallel/test-http-set-header-validation-cache.js b/test/parallel/test-http-set-header-validation-cache.js
@@ -0,0 +1,38 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
+
+const server = http.createServer(common.mustCall((req, res) => {
+  res.setHeader('Content-Type', 'application/json; charset=utf-8');
+  res.setHeader('X-Test', 'valid-value');
+  res.setHeader('Content-Type', 'application/json; charset=utf-8');
+  res.setHeader('X-Test', 'valid-value');
+
+  assert.throws(() => {
+    res.setHeader('X-Test', 'bad\u0007value');
+  }, { code: 'ERR_INVALID_CHAR' });
+
+  const cookies = ['a=1', 'b=2'];
+  res.setHeader('Set-Cookie', cookies);
+  cookies[1] = 'bad\r\nvalue';
+  assert.throws(() => {
+    res.setHeader('Set-Cookie', cookies);
+  }, { code: 'ERR_INVALID_CHAR' });
+  res.setHeader('Set-Cookie', 'ok=1');
+
+  assert.throws(() => {
+    res.setHeader('Bad Header', 'v');
+  }, { code: 'ERR_INVALID_HTTP_TOKEN' });
+
+  res.end('ok');
+}));
+
+server.listen(0, common.mustCall(() => {
+  http.get({ port: server.address().port }, common.mustCall((res) => {
+    assert.strictEqual(res.statusCode, 200);
+    res.resume();
+    res.on('end', common.mustCall(() => server.close()));
+  }));
+}));