Skip to content

fix: prevent Content-Type header from being set to 'false'#7035

Open
veeceey wants to merge 1 commit intoexpressjs:masterfrom
veeceey:fix/content-type-false-value
Open

fix: prevent Content-Type header from being set to 'false'#7035
veeceey wants to merge 1 commit intoexpressjs:masterfrom
veeceey:fix/content-type-false-value

Conversation

@veeceey
Copy link

@veeceey veeceey commented Feb 14, 2026

Fixes #7034

When res.set('Content-Type', value) is called with a value that mime.contentType() can't resolve (returns false), the header ends up being set to the literal string "false".

This happens because mime.contentType() returns false for unrecognized types, and that false gets passed straight to setHeader(), which coerces it to a string.

// before this fix:
res.set('Content-Type', 'custom-type');
// => Content-Type: false

The fix is a one-liner — fall back to the original value when mime.contentType() returns false. This is consistent with how res.type() already handles the same case (it falls back to 'application/octet-stream').

// after:
res.set('Content-Type', 'custom-type');
// => Content-Type: custom-type

Added a test to cover this edge case. Full test suite passes (1247 tests).

When res.set('Content-Type', value) is called with a value that
mime.contentType() cannot resolve, it returns false. This false
value was being passed directly to setHeader(), resulting in the
Content-Type header being set to the literal string "false".

Fall back to the original value when mime.contentType() returns
false, consistent with how res.type() already handles this case.

Fixes expressjs#7034
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

res.set('Content-Type') silently sets header to literal string 'false' for unknown types

1 participant