Skip to content

fix: return 400 for malformed Content-Type header (9.x) - #496

Merged
feugy merged 1 commit into
9.xfrom
fix/invalid-content-type-400-9.x
Nov 5, 2026
Merged

feugy merged 1 commit into
9.xfrom
fix/invalid-content-type-400-9.x

Conversation

@feugy

@feugy feugy commented Nov 5, 2026 •

Copy link
Copy Markdown
Member

🖖 What's in there?

Fixes a 500 on malformed Content-Type headers in buffer(), text() and json().

These functions parse the charset with content-type outside of any error handling. A header like Content-Type: application/json; (trailing semicolon) throws a raw TypeError: invalid parameter format, so micro answers with a 500. The fix wraps the parse and throws createError(400, 'Invalid Content-Type header', err), like the existing Invalid JSON and Invalid body errors.

Before Now
500 Internal Server Error 400 Invalid Content-Type header

This PR targets 9.x, which is new and starts at v9.3.5-canary.3. Services that still use micro@9.3.5-canary.3 can get the fix from a new canary release without moving to 10.x.

🤺 How to test?

curl -i -X POST localhost:3000 -H 'Content-Type: application/json;' -d '{}'

New tests in test/index.js:

  • json() returns 400 for application/json;, application/json; charset, application/json;; charset=utf-8 and application.
  • text() returns 400 for text/plain;.
  • buffer() with an explicit encoding still skips the parse.
  • json() still parses a body sent with application/json; charset=utf-8.

Local run on Node 12 with yarn test: lint passes, 66 tests pass. Without the fix, the 5 invalid-header tests fail.

🔬 Notes to reviewers

buffer(), text() and json() parsed the Content-Type charset without error handling. A malformed header such as 'application/json;' threw a raw TypeError, which callers answered with a 500. It now throws a 400 error with the message 'Invalid Content-Type header'.
@feugy
feugy merged commit d78228b into 9.x Nov 5, 2026
3 checks passed
@feugy feugy mentioned this pull request Nov 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants