Skip to content

fix(res.set): prevent Content-Type from being set to 'false' for unknown types - #7128

Closed
cyphercodes wants to merge 1 commit into
expressjs:masterfrom
cyphercodes:fix-content-type-false
Closed

fix(res.set): prevent Content-Type from being set to 'false' for unknown types#7128
cyphercodes wants to merge 1 commit into
expressjs:masterfrom
cyphercodes:fix-content-type-false

Conversation

@cyphercodes

Copy link
Copy Markdown
Contributor

Problem

When calling res.set('Content-Type', value) where the value doesn't contain a / (like a bare extension or shorthand), mime.contentType(value) is used to resolve the full MIME type. However, if mime.contentType() returns false (for unrecognized types), the Content-Type header is set to the literal string "false" instead of keeping the original value.

Reproduction

constexpress=require('express');constapp=express();app.get('/',(req,res)=>{res.set('Content-Type','some-custom-type');res.send('hello');});app.listen(3000);

Requesting / returns Content-Type: false in the response headers.

Root Cause

In res.set() (response.js), the Content-Type branch does:

if(field.toLowerCase()==='content-type'){if(Array.isArray(value)){thrownewTypeError('Content-Type cannot be set to an Array');}value=mime.contentType(value)// can return false!}this.setHeader(field,value);

When mime.contentType(value) returns false, the value false is passed to setHeader, which coerces it to the string "false".

Solution

This fix checks if mime.contentType() returns false and falls back to the original value instead:

varct=mime.contentType(value);if(ct!==false){value=ct;}

This is consistent with how res.type() handles unknown types.

Changes

  • Modified lib/response.js to handle the case when mime.contentType() returns false
  • Added test case in test/res.set.js to verify the fix

Fixes#7034

…own types
When res.set('Content-Type', value) is called with an unknown type,
mime.contentType() returns false. Previously, this false value was
passed to setHeader, which coerced it to the string 'false'.
This fix checks if mime.contentType() returns false and falls back
to the original value instead, consistent with how res.type() handles
unknown types.
Fixesexpressjs#7034
@krzysdz

Copy link
Copy Markdown
Contributor

Duplicate of#7035

@krzysdzkrzysdz marked this as a duplicate of #7035Mar 25, 2026
@krzysdzkrzysdz closed this Mar 25, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

res.set('Content-Type') silently sets header to literal string 'false' for unknown types

2 participants

@cyphercodes@krzysdz