From fe423c67c712d2e6f7a36e3a841e0e8480f7c4db Mon Sep 17 00:00:00 2001 From: DeepView Autofix <276251120+deepview-autofix@users.noreply.github.com> Date: Thu, 16 Apr 2026 01:22:59 +0300 Subject: [PATCH] fix: prevent Content-Type header from being set to "false" When `res.set('Content-Type', value)` is called with an unrecognized MIME type, `mime.contentType(value)` returns `false`. This `false` was passed directly to `setHeader`, corrupting the Content-Type header to the literal string "false". Fall back to the original value when `mime.contentType()` cannot resolve the type. Co-Authored-By: Claude Opus 4.6 Co-Authored-By: DeepView Autofix <276251120+deepview-autofix@users.noreply.github.com> Co-Authored-By: Nikita Skovoroda Signed-off-by: Nikita Skovoroda --- lib/response.js | 2 +- test/res.set.js | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/lib/response.js b/lib/response.js index f965e539dd2..bc2bc6fb438 100644 --- a/lib/response.js +++ b/lib/response.js @@ -673,7 +673,7 @@ res.header = function header(field, val) { if (Array.isArray(value)) { throw new TypeError('Content-Type cannot be set to an Array'); } - value = mime.contentType(value) + value = mime.contentType(value) || value } this.setHeader(field, value); diff --git a/test/res.set.js b/test/res.set.js index 04511c1c95f..725e74442fc 100644 --- a/test/res.set.js +++ b/test/res.set.js @@ -75,6 +75,20 @@ describe('res', function(){ .expect(200, done); }) + it('should not set Content-Type to "false" for unknown type', function (done) { + var app = express(); + + app.use(function (req, res) { + res.set('Content-Type', 'bogus'); + res.end(); + }); + + request(app) + .get('/') + .expect('Content-Type', 'bogus') + .expect(200, done); + }) + it('should throw when Content-Type is an array', function (done) { var app = express()