EC
ERR_HTTP_BODY_NOT_ALLOWED
Node.jsERRORNotableHTTPHIGH confidence

HTTP response body not allowed for this status code

Production Risk

Causes protocol violations that can confuse HTTP clients and proxies.

What this means

Thrown when a response body is written for an HTTP status code that must not include a body per the HTTP specification. Status codes 1xx, 204 No Content, and 304 Not Modified must not have a response body. Writing one is a protocol violation that Node.js now enforces.

Why it happens
  1. 1Calling res.write() or res.end(body) after res.writeHead(204)
  2. 2Sending a body with a 304 Not Modified response
  3. 3Sending a body with any 1xx informational response
How to reproduce

Triggered when body bytes are written to a response whose status code forbids a body.

trigger — this will error
trigger — this will error
const http = require('http');
http.createServer((req, res) => {
  res.writeHead(204);
  res.end('No content here'); // throws — 204 must have no body
}).listen(3000);

expected output

Error [ERR_HTTP_BODY_NOT_ALLOWED]: Adding content for this request method or response status is not allowed

Fix 1

Call res.end() with no arguments for bodyless status codes

WHEN When sending 204, 304, or 1xx responses

Call res.end() with no arguments for bodyless status codes
res.writeHead(204);
res.end(); // no body argument

Why this works

Calling end() without data sends the response with no body, conforming to the HTTP spec.

Fix 2

Use status 200 with a body if content must be sent

WHEN When the handler should return data to the client

Use status 200 with a body if content must be sent
res.writeHead(200, { 'Content-Type': 'application/json' });
res.end(JSON.stringify({ deleted: true }));

Why this works

Status 200 permits a body; include the status in the payload instead of relying on 204.

Code examples
Triggerjs
const http = require('http');
http.createServer((req, res) => {
  res.writeHead(204);
  res.end('No content here'); // throws — 204 must have no body
}).listen(3000);  // this triggers ERR_HTTP_BODY_NOT_ALLOWED
Handle in try/catchjs
try {
  // operation that may throw ERR_HTTP_BODY_NOT_ALLOWED
  riskyOperation()
} catch (err) {
  if (err.code === 'ERR_HTTP_BODY_NOT_ALLOWED') {
    console.error('ERR_HTTP_BODY_NOT_ALLOWED:', err.message)
  } else {
    throw err
  }
}
Defensive pattern to avoid itjs
// Validate inputs before calling the operation
function safe_err_http_body_not_allowed(...args) {
  // validate args here
  return performOperation(...args)
}
What not to do

✕ Send a body with 204 or 304 responses

These status codes are defined by HTTP to have no body; sending one is a protocol violation.

Sources
Official documentation ↗

Node.js Error Codes Documentation

Content generated with AI assistance and reviewed for accuracy. Found an error? hello@errcodes.dev

← All Node.js errors