Per spec (first line is from the XHR spec; others are from Fetch spec which it links to):

A request has an associated header list (a header list). Unless stated otherwise it is empty.
A header list consists of zero or more headers.
A header consists of a name and value.
A value is a byte sequence that matches the following conditions:

• Has no leading or trailing HTTP whitespace bytes.
• Contains no 0x00, 0x0A or 0x0D bytes.

Apparently only Firefox goes against the spec and supports null bytes for XMLHttpRequests (but not Fetch in general): https://wptdashboard.appspot.com/XMLHttpRequest/headers-normalize-response.htm

Should the tests be changed to reflect the spec, or the spec (and other browsers) updated to match Firefox?