Skip to content

fix(res.set): prevent Content-Type from being set to 'false' for unknown types#7128

Closed
cyphercodes wants to merge 1 commit intoexpressjs:masterfrom
cyphercodes:fix-content-type-false
Closed

fix(res.set): prevent Content-Type from being set to 'false' for unknown types#7128
cyphercodes wants to merge 1 commit intoexpressjs:masterfrom
cyphercodes:fix-content-type-false

Conversation

@cyphercodes
Copy link
Copy Markdown

Problem

When calling res.set('Content-Type', value) where the value doesn't contain a / (like a bare extension or shorthand), mime.contentType(value) is used to resolve the full MIME type. However, if mime.contentType() returns false (for unrecognized types), the Content-Type header is set to the literal string "false" instead of keeping the original value.

Reproduction

const express = require('express');
const app = express();

app.get('/', (req, res) => {
  res.set('Content-Type', 'some-custom-type');
  res.send('hello');
});

app.listen(3000);

Requesting / returns Content-Type: false in the response headers.

Root Cause

In res.set() (response.js), the Content-Type branch does:

if (field.toLowerCase() === 'content-type') {
  if (Array.isArray(value)) {
    throw new TypeError('Content-Type cannot be set to an Array');
  }
  value = mime.contentType(value)  // can return false!
}
this.setHeader(field, value);

When mime.contentType(value) returns false, the value false is passed to setHeader, which coerces it to the string "false".

Solution

This fix checks if mime.contentType() returns false and falls back to the original value instead:

var ct = mime.contentType(value);
if (ct !== false) {
  value = ct;
}

This is consistent with how res.type() handles unknown types.

Changes

  • Modified lib/response.js to handle the case when mime.contentType() returns false
  • Added test case in test/res.set.js to verify the fix

Fixes #7034

…own types

When res.set('Content-Type', value) is called with an unknown type,
mime.contentType() returns false. Previously, this false value was
passed to setHeader, which coerced it to the string 'false'.

This fix checks if mime.contentType() returns false and falls back
to the original value instead, consistent with how res.type() handles
unknown types.

Fixes expressjs#7034
@krzysdz
Copy link
Copy Markdown
Contributor

krzysdz commented Mar 25, 2026

Duplicate of #7035

@krzysdz krzysdz marked this as a duplicate of #7035 Mar 25, 2026
@krzysdz krzysdz closed this Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

res.set('Content-Type') silently sets header to literal string 'false' for unknown types

2 participants