We will produce an error if the user attempts to send a request with an invalid header name such as X-Header: x\r\nX-Another-Header. However, we don't validate the names of trailers. In the HTTP/1 path, this permits the user to perform header injection or similar shenanigans on an outbound request.

This doesn't seem to be an exploitable vulnerability under any likely scenario, since the user would need to be acquiring header names from an attacker-controlled source, but it's still something we should catch.