494 Request header too large

Request headers exceeding the configured buffer size on nginx or Akamai EAA produce the 494 Request header too large status code.

Table of Contents

Usage

The 494 Request header too large status code indicates the server is unwilling to process the HTTP request because the total header size or the content of one or more individual headers exceeds the allowed limit.

Akamai Enterprise Application Access (EAA) also returns 494 when an HTTP request header or browser cookie exceeds the configured proxy buffer value (default 4 KB). The EAA connector sits between the client and the origin application, enforcing its own buffer limits independently of the backend server configuration.

Example

A client sends a request with an oversized Cookie header. The nginx server records the failure as 494 Request header too large and, in the default configuration, answers the client with a 400 response carrying the built-in error page.

Request

GET /dashboard HTTP/1.1
Host: www.example.re
Cookie: session=abc123...(4096+ bytes)

Response

HTTP/1.1 400 Bad Request
Server: nginx
Content-Type: text/html
Connection: close

<html>
<head><title>400 Request Header Or Cookie Too Large</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>Request Header Or Cookie Too Large</center>
<hr><center>nginx</center>
</body>
</html>

The nginx error log records the oversized header:

client sent too long header line: "Cookie: session=abc123..."

Raising the header limits

Three directives govern the threshold, and each produces 494 on a different overflow.

Directive Default Overflow
client_header_buffer_size 1k Initial read, escalates
large_client_header_buffers 4 8k One field exceeds one buffer
max_headers 1000 Too many header lines

A single header field has to fit inside one buffer rather than across several, which is why a large Cookie triggers the condition while a long list of ordinary headers passes.

http {
    client_header_buffer_size 4k;
    large_client_header_buffers 4 16k;
}

Both directives belong at http level. Buffers are sized before the Host header is parsed, so a server-level value is read from the default server rather than the matching one, and the setting appears to have no effect.

The max_headers directive arrived in nginx 1.29.8 and caps the number of header lines rather than their size.

An oversized request line produces 414 instead, so an overlong URL and an overlong header land on different codes. Under HTTP/2, the same oversize condition surfaces as a stream reset or GOAWAY frame rather than a status code, so the client reports a connection error instead of 494.

The same limits apply on HTTP/2 and HTTP/3, where one buffer bounds the compressed size of a field and the decompressed total is checked separately.

Diagnosis needs a raised log level. nginx records "client sent too large request", "client sent too long header line", and "client sent too many header lines" at info level, which the default error log setting discards.

error_log /var/log/nginx/error.log info;

A friendly page catches the internal code rather than the 400 the client sees.

error_page 494 =400 /errors/header-too-large.html;

How to fix

Two nginx directives control header buffer sizes. The client_header_buffer_size handles initial header reads (default 1 KB). When headers exceed this buffer, nginx falls back to large_client_header_buffers (default four buffers at 8 KB each).

Increase both values in nginx.conf under the http block:

client_header_buffer_size 4k;
large_client_header_buffers 4 16k;

A single request header line (one header name and value) must fit within a single buffer. If one Cookie header exceeds 16 KB, the buffer size needs to grow beyond 16k regardless of the buffer count.

Reload nginx after making changes:

nginx -t && systemctl reload nginx

Reduce header size on the client side. Oversized Cookie headers from runaway cookie growth are the most frequent cause. Clear unnecessary cookies, consolidate tracking cookies, and shorten custom header values.

Audit application cookie behavior. Session frameworks, analytics scripts, and advertising pixels each add cookies. A domain accumulating dozens of cookies over time pushes total header size past default limits.

For Kubernetes environments using nginx Ingress, set buffer sizes through annotations or ConfigMap entries:

nginx.ingress.kubernetes.io/client-header-buffer-size: "4k"
nginx.ingress.kubernetes.io/large-client-header-buffers: "4 16k"

For Akamai EAA, increase the Proxy Buffer Size in the Advanced tab under the Miscellaneous section for the affected application in the Enterprise Center console.

This error is functionally identical to 431 but specific to nginx and Akamai EAA internal handling.

See also

Last updated: August 17, 2026