The current implementation doesn't take into account the X-Forwarded-Host header may contain multiple values.
From the Apache mod_proxy docs:

Be careful when using these headers on the origin server, since they will contain more than one (comma-separated) value if the original request already contained one of these headers.

Probably in such case you should take the first value from the list.