Skip to content

fix: handle unknown Content-Type in res.set() falling back to original value#7106

Closed
AkaHarshit wants to merge 1 commit intoexpressjs:masterfrom
AkaHarshit:fix/content-type-false-value
Closed

fix: handle unknown Content-Type in res.set() falling back to original value#7106
AkaHarshit wants to merge 1 commit intoexpressjs:masterfrom
AkaHarshit:fix/content-type-false-value

Conversation

@AkaHarshit
Copy link
Contributor

Problem

When calling res.set('Content-Type', value) where the value doesn't contain a / (like a bare extension or shorthand), mime.contentType(value) is used to resolve the full MIME type. However, if mime.contentType() returns false (for unrecognized types), the Content-Type header is set to the literal string "false" instead of keeping the original value.

Reproduction:

const express = require('express');
const app = express();

app.get('/', (req, res) => {
  res.set('Content-Type', 'some-custom-type');
  res.send('hello');
});

app.listen(3000);

Requesting / returns Content-Type: false in the response headers.

Solution

In res.set() (lib/response.js), added a fallback to the original value when mime.contentType() returns false:

- value = mime.contentType(value)
+ value = mime.contentType(value) || value

This mirrors how res.type() already handles the same scenario:

var ct = type.indexOf('/') === -1
  ? (mime.contentType(type) || 'application/octet-stream')
  : type;

Why It Matters

  • Prevents silently invalid Content-Type: false headers being sent to clients
  • Makes res.set('Content-Type') behavior consistent with res.type()
  • Allows custom Content-Type values that aren't in the MIME database to be used as-is

Testing

Added two new test cases to test/res.set.js:

  1. should fall back to original value for unknown Content-Type — Verifies that res.set('Content-Type', 'some-custom-type') preserves the original value instead of setting 'false'
  2. should resolve known Content-Type shorthands — Verifies that res.set('Content-Type', 'html') correctly resolves to text/html; charset=utf-8

Full test suite passes: 1249 passing, 0 failing.

Linked Issue

Fixes: #7034

…l value

When mime.contentType() returns false for unrecognized types,
res.set('Content-Type', value) was setting the header to the
literal string 'false'. This change falls back to the original
value, matching how res.type() already handles this case.

Fixes: expressjs#7034
@krzysdz
Copy link
Contributor

krzysdz commented Mar 15, 2026

Duplicate of #7035

@krzysdz krzysdz marked this as a duplicate of #7035 Mar 15, 2026
@krzysdz krzysdz closed this Mar 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

res.set('Content-Type') silently sets header to literal string 'false' for unknown types

2 participants