fulmine.js 5.12.0 → 5.12.2

package/README.md

@@ -285,6 +285,7 @@ A single-stage `node:26-trixie-slim` image works too if you `apt-get install -y
 - `app.listen()` returns the app rather than a separate server object, and the app answers as an `http.Server`: `app instanceof http.Server` is true, which is what the graceful shutdown wrappers and the connection trackers look for. There is still no node server underneath, the socket belongs to µWS, so what is answered is the surface and not the plumbing. There: `close()`, `address()`, `listening`, `getConnections()`, `ref()`, `unref()`, `setTimeout()` and the `keepAliveTimeout` family. Not there: nothing emits `connection`, `request` or `upgrade`, `getConnections()` counts the requests in flight rather than sockets, and the timeouts belong to µWS and are set through `uwsOptions.idleTimeout`. Anything that wants to serve its own protocol on the socket, socket.io being the usual case, still wants `app.uwsApp`. Runnable: [`examples/graceful-shutdown.js`](./examples/graceful-shutdown.js).
 - `x-powered-by` is disabled by default. Express sends `X-Powered-By: Express` unless you turn it off; Fulmine does not send it unless you turn it on with `app.set("x-powered-by", true)`. The header only tells anyone asking which framework is running.
 - request body is only read for POST, PUT, PATCH and QUERY requests by default. You can add additional methods by setting `body methods` to array with uppercased methods.
+- **A request whose `Content-Length` cannot be trusted is refused by hanging up, with no answer at all.** Node's parser refuses two of these with a `400` and Fulmine refuses the same two: a repeated `Content-Length`, whatever the values say, and one that is not a plain count of bytes, an empty value included. µWS accepts both and frames the request on the first value, or on no body at all, so what the client sent as a body is read as the next request on the connection: that is request smuggling, and a proxy in front reading the other value is all it takes. The answer differs from Express because it cannot be helped. µWS only skips the request it has already queued when the response is closed rather than completed, and writing the `400` completes it, so the choice is between telling the client and stopping the smuggled request. Nothing well behaved sends two content-lengths.
 - **A compiled route answers `connection: keep-alive` to a client that sent `Connection: close`.** A handler simple enough to be read at registration time is answered by µWS from a response written once at `listen()`, and that response cannot read the request. The socket still closes, so what is wrong is the header and not the transport. A response that would carry a validator is never compiled, so conditional requests behave as on Express; `app.set("declarative responses", false)` turns compiling off.
 - **Informational responses go nowhere.** `res.writeEarlyHints()`, `res.writeContinue()` and `res.writeProcessing()` are all there, take what node's take and throw what node's throw once the head has gone out, but nothing reaches the wire: µWebSockets.js has no API for a `1xx`. They exist so that code written for Express keeps running rather than dying on "is not a function", which is the only thing a drop-in can honestly promise here. `res.addTrailers()` is the same story, and `res.setTimeout()` and `req.setTimeout()` register the listener without changing anything, since µWS runs its own idle timeout through `uwsOptions.idleTimeout`.
 - For HTTPS, instead of doing this:

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.12.0",
+    "version": "5.12.2",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "bin": {

package/src/application.js

@@ -208,11 +208,11 @@ class Application extends Router {
             // a "trust proxy" this app never set is inherited from the parent, as express does:
             // the defaults are deleted so get() falls through to the parent's value
             if (
-                this.settings[trustProxyDefaultSymbol] === true &&
-                typeof parent.settings["trust proxy fn"] === "function"
+                this._settings[trustProxyDefaultSymbol] === true &&
+                typeof parent._settings["trust proxy fn"] === "function"
             ) {
-                delete this.settings["trust proxy"];
-                delete this.settings["trust proxy fn"];
+                delete this._settings["trust proxy"];
+                delete this._settings["trust proxy fn"];
             }
         });
         this.listenCalled = false;
@@ -248,20 +248,20 @@ class Application extends Router {
         this._draining = false;
         // read here, at construction, the way express does; an empty NODE_ENV means development,
         // which the ?? in the shared default would miss
-        if (typeof this.settings.env === "undefined") {
-            this.settings.env = process.env.NODE_ENV || "development";
+        if (typeof this._settings.env === "undefined") {
+            this._settings.env = process.env.NODE_ENV || "development";
         }
         for (const key in defaultSettings) {
-            if (typeof this.settings[key] === "undefined") {
+            if (typeof this._settings[key] === "undefined") {
                 if (typeof defaultSettings[key] === "function") {
-                    this.settings[key] = defaultSettings[key](this);
+                    this._settings[key] = defaultSettings[key](this);
                 } else {
-                    this.settings[key] = defaultSettings[key];
+                    this._settings[key] = defaultSettings[key];
                 }
             }
         }
         // non-enumerable, so the marker never shows up walking the settings
-        Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+        Object.defineProperty(this._settings, trustProxyDefaultSymbol, {
             configurable: true,
             value: true
         });
@@ -372,27 +372,27 @@ class Application extends Router {
             if (!value) {
                 // compiled, not deleted: an explicit false must shadow a parent's setting when
                 // this app is mounted, and a deleted key would read straight through to it
-                this.settings["trust proxy fn"] = compileTrust(false);
+                this._settings["trust proxy fn"] = compileTrust(false);
             } else {
-                this.settings["trust proxy fn"] = compileTrust(value);
+                this._settings["trust proxy fn"] = compileTrust(value);
             }
             // set explicitly, so a mount no longer inherits the parent's
-            Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+            Object.defineProperty(this._settings, trustProxyDefaultSymbol, {
                 configurable: true,
                 value: false
             });
         } else if (key === "stat cache") {
             // compiled here so the read path is a number and not a duration to parse per request
-            this.settings["stat cache ms"] = durationSetting(value, "stat cache");
+            this._settings["stat cache ms"] = durationSetting(value, "stat cache");
         } else if (key === "query parser") {
             if (value === "extended") {
-                this.settings["query parser fn"] = fastQueryParse;
+                this._settings["query parser fn"] = fastQueryParse;
             } else if (value === "simple" || value === true) {
-                this.settings["query parser fn"] = parseQuery;
+                this._settings["query parser fn"] = parseQuery;
             } else if (typeof value === "function") {
-                this.settings["query parser fn"] = value;
+                this._settings["query parser fn"] = value;
             } else if (value === false) {
-                this.settings["query parser fn"] = undefined;
+                this._settings["query parser fn"] = undefined;
             } else {
                 // express's wording, which applications match on
                 throw new TypeError("unknown value for query parser function: " + value);
@@ -414,18 +414,18 @@ class Application extends Router {
             // request. Registering a route or a middleware after listen still takes them back,
             // see router.js:1615: that is a different question, about code the analysis never saw.
             if (typeof value === "function") {
-                this.settings["etag fn"] = value;
+                this._settings["etag fn"] = value;
             } else {
                 switch (value) {
                     case true:
                     case "weak":
-                        this.settings["etag fn"] = createETagGenerator({ weak: true });
+                        this._settings["etag fn"] = createETagGenerator({ weak: true });
                         break;
                     case "strong":
-                        this.settings["etag fn"] = createETagGenerator({ weak: false });
+                        this._settings["etag fn"] = createETagGenerator({ weak: false });
                         break;
                     case false:
-                        delete this.settings["etag fn"];
+                        delete this._settings["etag fn"];
                         break;
                     default:
                         // express's wording, which applications match on
@@ -434,7 +434,7 @@ class Application extends Router {
             }
         }
 
-        this.settings[key] = value;
+        this._settings[key] = value;
         // any app's hot-settings copy may resolve through this one, see Router#_hot
         settingsEpoch.n++;
         return this;
@@ -529,6 +529,9 @@ class Application extends Router {
     _serveGeneric(res, req) {
         const request = this.handleRequest(res, req);
         const response = request.res;
+        if (request._badFraming === true) {
+            return this._refuseFraming(response);
+        }
         try {
             this._routeRequestDirect(request, response);
         } finally {

package/src/middlewares.js

@@ -538,7 +538,7 @@ function serveStatic(root, options) {
                 filePath,
                 req.headers["accept-encoding"],
                 twinTtl,
-                req.app.settings["stat cache ms"]
+                req.app._settings["stat cache ms"]
             );
             if (twin) {
                 stat = twin.stat;
@@ -546,7 +546,7 @@ function serveStatic(root, options) {
         }
         try {
             if (stat === undefined) {
-                stat = cachedStat(statTarget, req.app.settings["stat cache ms"]);
+                stat = cachedStat(statTarget, req.app._settings["stat cache ms"]);
             }
         } catch (err) {
             // the one to report when nothing is found: send hands each failed attempt to the next
@@ -656,7 +656,12 @@ function serveStatic(root, options) {
             // already found before the stat below, on the ordinary path
             const variant =
                 twin ??
-                pickPrecompressed(filePath, req.headers["accept-encoding"], twinTtl, req.app.settings["stat cache ms"]);
+                pickPrecompressed(
+                    filePath,
+                    req.headers["accept-encoding"],
+                    twinTtl,
+                    req.app._settings["stat cache ms"]
+                );
             if (variant) {
                 _path += variant.suffix;
                 stat = variant.stat;

package/src/request.js

@@ -152,6 +152,30 @@ const discardedDuplicates = new Set([
 // 128 KB of body buffered before uWS is asked to pause
 const READABLE_OPTIONS = { highWaterMark: 128 * 1024 };
 
+/**
+ * Whether a content-length is a plain count of bytes, which is the only thing RFC 9112 allows.
+ *
+ * uWS trims the spaces around the value and then takes whatever is left, so "", "abc", "+1", "-1",
+ * "0x10" and "1e2" all arrive here. Every one of them makes uWS frame the request as carrying no
+ * body, and what the client sent as a body is then read as the next request on the connection.
+ * Node's parser refuses all of them outright, and so does this.
+ *
+ * @param {string} value as uWS hands it over
+ * @returns {boolean}
+ */
+function isByteCount(value) {
+    if (value.length === 0) {
+        return false;
+    }
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 0x30 || code > 0x39) {
+            return false;
+        }
+    }
+    return true;
+}
+
 // Whose headers the shared collector below is filling. uWS's forEach is synchronous and runs no
 // user code, so the handoff cannot interleave; module-level so the callback exists once instead
 // of once per request.
@@ -336,6 +360,15 @@ module.exports = class Request extends LazyReadable {
             (headerKey.length === 14 && headerKey === "content-length") ||
             (headerKey.length === 17 && headerKey === "transfer-encoding")
         ) {
+            if (headerKey.length === 14) {
+                // a second content-length whatever it says, and one that is not a count of bytes:
+                // both make uWS frame the request differently from what is on the wire, see
+                // _badFraming and isByteCount
+                if (r._sawContentLength || !isByteCount(value)) {
+                    r._badFraming = true;
+                }
+                r._sawContentLength = true;
+            }
             // saying anything about framing at all, "0" included. A parser that can see a
             // content-length answers about the body it describes, even an empty one: a zero length
             // with a charset nobody can decode is a 415 in express and here, so a chain may only
@@ -439,6 +472,33 @@ module.exports = class Request extends LazyReadable {
      */
     _hasBodyHeaders;
 
+    /**
+     * Whether a content-length has already been copied, so a second one is spotted. Declared for
+     * the same reason as rawIp.
+     * @type {boolean|undefined}
+     */
+    _sawContentLength;
+
+    /**
+     * Whether the request said two different things about how long its body is, so uWS may have
+     * framed it differently from the client that sent it and the proxy that forwarded it. Two
+     * shapes reach this, and node's parser refuses both outright:
+     *
+     *   a repeated content-length     uWS frames on the first and drops the rest, so a proxy in
+     *                                 front reading the last one instead forwards bytes uWS then
+     *                                 answers as a second, pipelined request
+     *   one that is not a byte count  uWS keeps whatever is left after trimming, an empty value
+     *                                 included, and frames the request as carrying no body at all,
+     *                                 which turns the body the client sent into that same second
+     *                                 request. See isByteCount
+     *
+     * Either way it is request smuggling, and the request is refused rather than routed. Declared
+     * for the same reason as rawIp.
+     *
+     * @type {boolean|undefined}
+     */
+    _badFraming;
+
     /**
      * Whether the client asked for the connection to be closed. Declared for the same reason.
      * @type {boolean|undefined}
@@ -504,10 +564,18 @@ module.exports = class Request extends LazyReadable {
             // which is 0.2us on a request that is about to read a body.
             const length = req.getHeader("content-length");
             const transferEncoding = req.getHeader("transfer-encoding");
+            // A content-length of "0" declares no body and used to stay on the cheap side, but
+            // getHeader only ever returns the first of a repeated header, so a duplicate cannot be
+            // seen from here, and a duplicate has to be refused rather than routed: see
+            // _badFraming. Anything that says a word about framing takes the full copy instead.
+            //
+            // One shape stays invisible here, a content-length present with an empty value: uWS
+            // answers "" for that and for a header that was never sent, and nothing in its API
+            // tells them apart. It frames both as carrying no body, which is the right reading of
+            // the second, so this server stays consistent with itself either way. The full copy
+            // below does refuse it, which is every request except a GET whose whole chain provably
+            // reads no header at all.
             if (length !== "" || transferEncoding !== "") {
-                this._hasBodyHeaders = true;
-            }
-            if ((length !== "" && length !== "0") || transferEncoding !== "") {
                 currentRequest = this;
                 this._req.forEach(Request.#collectHeader);
                 currentRequest = null;

package/src/response.js

@@ -296,7 +296,7 @@ module.exports = class Response extends LazyWritable {
         // "connection headers" off advertises neither, which Express always does: see below for
         // the one this still writes.
         this.headers =
-            res._nodeRes || app.settings["connection headers"] === false
+            res._nodeRes || app._settings["connection headers"] === false
                 ? {}
                 : {
                       connection: "keep-alive",
@@ -1066,7 +1066,7 @@ module.exports = class Response extends LazyWritable {
         let stat = options._stat;
         if (!stat) {
             try {
-                stat = cachedStat(fullpath, this.app.settings["stat cache ms"]);
+                stat = cachedStat(fullpath, this.app._settings["stat cache ms"]);
             } catch (err) {
                 // the fs error itself, carrying its errno and path, with send's status written on
                 // it: a missing file is the request's 404, an unreadable one is the server's 500

package/src/router.js

@@ -178,7 +178,10 @@ class Walk {
         // inside the route. req.next itself is left alone: making it mean this everywhere is what
         // express does, and it breaks express own res.format and app.routes.error tests here, so
         // that stays open rather than half done.
-        this.leaveRoute = this.stepOutOfRoute.bind(this);
+        //
+        // Null here and bound on the first route that has more than one callback, which is the
+        // only shape that ever reads it: a request that never meets one paid a bind for nothing
+        this.leaveRoute = null;
     }
 
     /**
@@ -238,7 +241,18 @@ class Walk {
             // was one closure per hop of every request not on a compiled chain
             for (; routeIndex < routes.length; routeIndex++) {
                 const r = routes[routeIndex];
-                if (!(r.all || r.method === req.method || req._isOptions || (r.gettable && req._isHead))) {
+                // A HEAD request enters a route whose path matched even when its verb cannot serve
+                // one: express exempts HEAD from the method check ("if (!hasMethod && method !==
+                // 'HEAD')" in router/index.js), so the layer's parameters are captured and its
+                // param() callbacks run before the route is dropped. Only asked when the router has
+                // callbacks to run, since entering a route to step straight back out of it is
+                // otherwise pure cost with nothing to show for it. runRoute steps over it.
+                if (!(
+                    r.all ||
+                    r.method === req.method ||
+                    req._isOptions ||
+                    (req._isHead && (r.gettable || r.paramCallbacks.size > 0))
+                )) {
                     // taken only to fail: _preprocessRequest decodes again and turns it into the
                     // error, so the handlers of a route this request cannot run never see it
                     if (mayFailDecode && router._pathMatches(r, req) && router._paramsFailToDecode(r, req)) {
@@ -362,7 +376,7 @@ class Walk {
         // express hands res.format's handlers the next its own layer received, and its test asserts
         // that identity. With more than one callback the two differ for real, and what express
         // hands over is the one that leaves the route
-        req._leaveRoute = route.callbacks.length > 1 ? this.leaveRoute : this.next;
+        req._leaveRoute = route.callbacks.length > 1 ? (this.leaveRoute ??= this.stepOutOfRoute.bind(this)) : this.next;
         if (continueRoute === "route") {
             this.step("route");
         } else if (continueRoute) {
@@ -475,7 +489,7 @@ class Walk {
                 rememberApp(this, route, req);
                 useApp(req, callback);
             }
-            const pushedParams = callback.settings.mergeParams;
+            const pushedParams = callback._settings.mergeParams;
             if (pushedParams) {
                 (req._paramStack ??= []).push(req.params);
             }
@@ -511,20 +525,20 @@ class Walk {
                     if (parentMethods !== null) {
                         req._matchedMethods = parentMethods;
                     }
-                    if (req._isOptions && childMethods.size) {
+                    if (req._isOptions && childMethods.size && !req._error) {
                         // OPTIONS routing is different, it stops in the router if matched.
                         // Express answers as the router hands back, so a throw while answering,
                         // a head already written being the way, walks on to later error handlers
-                        if (!req._error) {
-                            try {
-                                router._sendOptionsReply(req, res, childMethods);
-                                return this.resolve(true);
-                            } catch (err) {
-                                return this.step(err);
-                            }
+                        try {
+                            router._sendOptionsReply(req, res, childMethods);
+                            return this.resolve(true);
+                        } catch (err) {
+                            return this.step(err);
                         }
-                        return this.resolve(false);
                     }
+                    // An error carried out of the mount is not answered by the automatic reply, and
+                    // stopping here handed it to the default page: express walks on to the error
+                    // handlers written after the mount, for OPTIONS as for any other method.
                     this.step(undefined);
                 })
                 // a rejection out of the nested walk, or a throw above, must reject this one
@@ -547,6 +561,11 @@ class Walk {
                     }
                     return this.step(undefined);
                 }
+                // entered only so its param callbacks could run, see the scan in dispatch: the verb
+                // cannot serve a HEAD, so nothing here answers it
+                if (req._isHead && !route.all && !route.gettable && route.method !== "HEAD") {
+                    return this.step(undefined);
+                }
 
                 const out = callback(req, res, this.next);
                 if (out instanceof Promise) {
@@ -668,6 +687,42 @@ function setMountedPath(req) {
     req._lastUrl = req.url;
 }
 
+const NO_PARAM_NAMES = [];
+
+/**
+ * The parameter names a route captures with its own pattern.
+ *
+ * This is the set express runs param callbacks for. A name that reached req.params from a mount
+ * above, through mergeParams, belongs to that mount's router and not to this one, and express does
+ * not call this router's param() for it: it walks the keys the layer itself matched. Reading
+ * req.params instead ran a callback for every inherited name too, which is visible whenever such a
+ * callback does anything, and turned a 200 into a 500 when one of them refused the value.
+ *
+ * Worked out once per route and kept, since it follows from the pattern and never changes.
+ *
+ * @param {any} route
+ * @returns {string[]}
+ */
+function ownParamNames(route) {
+    let names = route._ownParamNames;
+    if (names !== undefined) {
+        return names;
+    }
+    if (route.optimizedParams) {
+        // µWS matched the pattern and hands the values back by position, under these names
+        names = route.optimizedParams;
+    } else if (route.pattern instanceof RegExp) {
+        const meta = getPatternMeta(route.pattern);
+        // outputNames is what _extractParams writes into params; a RegExp the application wrote
+        // itself was never compiled here, so its capture groups are the names
+        names = meta ? meta.outputNames : regexpGroupKeys(route.pattern);
+    } else {
+        names = NO_PARAM_NAMES;
+    }
+    route._ownParamNames = names;
+    return names;
+}
+
 /**
  * Whether this route reads the parameters of the mounts above it, which is its own router asking
  * for them. The stack holds what a mergeParams router captured on the way in, and a plain router
@@ -679,7 +734,7 @@ function setMountedPath(req) {
  */
 function mergesParams(route, fallback) {
     const owner = route.owner ?? fallback;
-    return Boolean(owner?.settings?.mergeParams);
+    return Boolean(owner?._settings?.mergeParams);
 }
 
 /**
@@ -819,6 +874,46 @@ function onNativeAborted() {
     response.socket?.emit("error", err);
 }
 
+/**
+ * What app.settings is wrapped in, so a write that never went through set() still tells the hot
+ * copies they are out of date. Only writes are trapped: a missing trap is the plain operation on
+ * the object itself, so reads through here behave exactly as they did.
+ *
+ * defineProperty is here for the trust proxy default marker, which set() writes that way, and for
+ * anything else reaching for Object.defineProperty rather than an assignment.
+ */
+const settingsWriteTraps = {
+    /**
+     * @param {any} target
+     * @param {string|symbol} key
+     * @param {any} value
+     */
+    set(target, key, value) {
+        target[key] = value;
+        settingsEpoch.n++;
+        return true;
+    },
+    /**
+     * @param {any} target
+     * @param {string|symbol} key
+     */
+    deleteProperty(target, key) {
+        delete target[key];
+        settingsEpoch.n++;
+        return true;
+    },
+    /**
+     * @param {any} target
+     * @param {string|symbol} key
+     * @param {any} descriptor
+     */
+    defineProperty(target, key, descriptor) {
+        Object.defineProperty(target, key, descriptor);
+        settingsEpoch.n++;
+        return true;
+    }
+};
+
 /**
  * The per-request constants of a fully literal native registration. µWS matched the URL byte for
  * byte against this exact pattern and dispatches by method, so the request constructor can take
@@ -1294,19 +1389,26 @@ module.exports = class Router extends EventEmitter {
         // an array when mounted on several paths at once, as Express allows
         /** @type {string|string[]} */
         this.mountpath = "/";
-        this.settings = settings;
+        // The settings twice: the plain object everything inside here reads, and the Proxy the
+        // outside gets. Express lets an application write app.settings["x"] straight, which set()
+        // never sees, so the hot copies in _hot() would keep answering the old value until an
+        // unrelated set() happened to bump the epoch and the change landed by surprise. The trap
+        // bumps it on the spot. Reading through a Proxy costs about 20ns, which is why the inside
+        // never does: _settings is the same object without the wrapper.
+        this._settings = settings;
+        this.settings = new Proxy(settings, settingsWriteTraps);
         // the base classes; an Application replaces these with its own per-app subclasses, and a
         // plain router has no request/response prototype layer, as in Express
         this._request = Request;
         this._response = Response;
 
         if (typeof settings.caseSensitive !== "undefined") {
-            this.settings["case sensitive routing"] = settings.caseSensitive;
-            delete this.settings.caseSensitive;
+            settings["case sensitive routing"] = settings.caseSensitive;
+            delete settings.caseSensitive;
         }
         if (typeof settings.strict !== "undefined") {
-            this.settings["strict routing"] = settings.strict;
-            delete this.settings.strict;
+            settings["strict routing"] = settings.strict;
+            delete settings.strict;
         }
     }
 
@@ -1393,7 +1495,8 @@ module.exports = class Router extends EventEmitter {
     get(path, ...callbacks) {
         if (typeof path === "string" && callbacks.length === 0) {
             const key = path;
-            const res = this.settings[key];
+            // the raw object, not the Proxy: see the constructor
+            const res = this._settings[key];
             if (typeof res === "undefined" && this.parent) {
                 return this.parent.get(key);
             } else {
@@ -1441,7 +1544,7 @@ module.exports = class Router extends EventEmitter {
      * @returns {boolean}
      */
     _routingFlag(key) {
-        const own = this.settings[key];
+        const own = this._settings[key];
         if (typeof own !== "undefined") {
             return Boolean(own);
         }
@@ -2014,6 +2117,30 @@ module.exports = class Router extends EventEmitter {
         return request;
     }
 
+    /**
+     * Refuses a request whose framing cannot be trusted and hangs up without answering. No route
+     * runs, so nothing downstream can be reached by one.
+     *
+     * Hanging up is the whole point: uWS has already read what followed the body it believed in as
+     * a second, pipelined request, and it dispatches that one unless the socket goes. Node answers
+     * 400 and then closes, and this cannot do both: uWS only skips the queued request when the
+     * response is closed rather than completed, and any of writeStatus, end or endWithoutBody
+     * completes it. Measured every combination, and delivering the 400 always let the smuggled
+     * request through, so the close wins and the client gets nothing. Nothing legitimate sends two
+     * content-lengths, so there is no well-behaved client to explain it to.
+     *
+     * Called once handleRequest has fully returned, never from inside it: an Application links the
+     * response into its pending list after the base call, and the 'close' emitted here is what
+     * takes it back out again.
+     *
+     * @param {any} response
+     */
+    _refuseFraming(response) {
+        response.finished = true;
+        response._res.close();
+        response.emit("close");
+    }
+
     /**
      * Tells uWS whom to call on a client abort. Out of handleRequest, because uWS only needs it
      * for a response that outlives its handler callback: the native handler arms it in its
@@ -2120,6 +2247,9 @@ module.exports = class Router extends EventEmitter {
                 }
                 const request = this.handleRequest(res, req, preset, skipHolder);
                 const response = request.res;
+                if (request._badFraming === true) {
+                    return this._refuseFraming(response);
+                }
                 if (optimizedParams) {
                     request.optimizedParams = new NullObject();
                     for (let i = 0; i < optimizedParams.length; i++) {
@@ -2436,8 +2566,14 @@ module.exports = class Router extends EventEmitter {
 
         // the route's own router's callbacks: an optimized chain is walked by the app even when it
         // ends in a mounted router's route
+        //
+        // A route an OPTIONS request reaches only to have its verb counted for the automatic reply
+        // is not a route this request runs, and express does not run its app.param() callbacks for
+        // it. The same condition runRoute counts the verb under, see the OPTIONS branch there. The
+        // decoding above still happens either way, because express decodes a layer whose path
+        // matched whatever its method is, which is what answers 400 for a malformed escape.
         const paramCallbacks = route.paramCallbacks;
-        if (paramCallbacks.size > 0) {
+        if (paramCallbacks.size > 0 && !(req._isOptions && !route.all && route.method !== "OPTIONS")) {
             return this._runParamCallbacks(req, res, route, paramCallbacks);
         }
         return true;
@@ -2480,9 +2616,14 @@ module.exports = class Router extends EventEmitter {
      * @returns {Promise<true|"route">|true}
      */
     _runParamCallbacks(req, res, route, paramCallbacks) {
+        // the names this route captured itself, not everything in req.params: a merged-in name
+        // belongs to the mount that captured it, see ownParamNames
         let names;
-        for (const name in req.params) {
-            if (paramCallbacks.has(name)) {
+        const own = ownParamNames(route);
+        for (let i = 0; i < own.length; i++) {
+            const name = own[i];
+            // an optional group that did not match leaves no parameter to call anything for
+            if (paramCallbacks.has(name) && req.params[name] !== undefined) {
                 (names ??= []).push(name);
             }
         }

package/src/utils.js

@@ -596,13 +596,23 @@ function canBeOptimizedWithParams(pattern) {
     return true;
 }
 
+// What makes a segment something other than the text it is written as: a parameter, a wildcard, an
+// optional group, or an escape. Only two plain literals can prove that two paths never meet, so
+// anything carrying one of these has to be read as "could be anything".
+const NOT_A_LITERAL = /[:*{}\\]/;
+
 /**
  * Whether two paths could both match the same request.
  *
- * Only asked about paths µWS could match itself, so the answer is structural: the same number of
- * segments, and no position where two different literals meet. `/orders/:id` and `/invoices/:id`
- * cannot both match, `/users/:id` and `/users/me` can. Anything else is not asked, and the caller
- * reads "do not know" as yes.
+ * The answer is structural: no position where two different literals meet, and, when neither path
+ * can change length, the same number of segments. `/orders/:id` and `/invoices/:id` cannot both
+ * match, `/users/:id` and `/users/me` can. The caller reads "do not know" as yes, so every doubt
+ * answers true: saying two paths overlap only costs a native registration, while missing one lets
+ * µWS answer a request that belonged to an earlier route.
+ *
+ * A parameter is not the only shape that matches more than itself. A wildcard and an optional group
+ * do too, and reading `{:opt}` or `*splat` as the literal text it is written as reported "cannot
+ * overlap" for a route that plainly could, which took the earlier route's turn away.
  *
  * @param {string} a
  * @param {string} b
@@ -612,15 +622,19 @@ function canBeOptimizedWithParams(pattern) {
 function pathsCanOverlap(a, b, aIsPrefix = false) {
     const left = a.split("/");
     const right = b.split("/");
-    if (aIsPrefix ? left.length > right.length : left.length !== right.length) {
+    // An optional group matches its segment or nothing at all and a wildcard matches several, so a
+    // path carrying either one matches more than one length and the count settles nothing.
+    const fixedLength =
+        a.indexOf("{") === -1 && b.indexOf("{") === -1 && a.indexOf("*") === -1 && b.indexOf("*") === -1;
+    if (fixedLength && (aIsPrefix ? left.length > right.length : left.length !== right.length)) {
         return false;
     }
-    for (let i = 0; i < left.length; i++) {
+    const shared = left.length < right.length ? left.length : right.length;
+    for (let i = 0; i < shared; i++) {
         if (left[i] === right[i]) {
             continue;
         }
-        // a parameter matches whatever is in that segment, so only two different literals settle it
-        if (left[i].charCodeAt(0) === 0x3a || right[i].charCodeAt(0) === 0x3a) {
+        if (NOT_A_LITERAL.test(left[i]) || NOT_A_LITERAL.test(right[i])) {
             continue;
         }
         return false;
@@ -1436,6 +1450,32 @@ function withUtf8Charset(value) {
 const HEADER_TOKEN = /^[\^_`a-zA-Z\-0-9!#$%&'*+.|~]+$/;
 const HEADER_VALUE = /[^\t\x20-\x7e\x80-\xff]/;
 
+/**
+ * One of node's header errors, built the way node builds it.
+ *
+ * Assigning the code is not the whole of it. Node also puts the code in the first line of the
+ * stack, by naming the error "TypeError [THE_CODE]" while V8 formats that line and then taking
+ * the name back off. Whatever prints a stack therefore says which code it was, and the default
+ * error page prints exactly that: without this, the same refusal reads "TypeError:" here and
+ * "TypeError [ERR_INVALID_CHAR]:" behind Express. Found by fuzzing against express.
+ *
+ * @param {string} message
+ * @param {string} code
+ * @returns {NodeJS.ErrnoException}
+ */
+function headerError(message, code) {
+    /** @type {NodeJS.ErrnoException} */
+    const err = new TypeError(message);
+    err.name = `TypeError [${code}]`;
+    // reading it is what makes V8 format the line, and it formats it from the name above
+    void err.stack;
+    // back to the prototype's "TypeError", which is what node leaves behind. Cast because Error
+    // declares name as always present, and this deletes the own property to uncover it again
+    delete (/** @type {any} */ (err).name);
+    err.code = code;
+    return err;
+}
+
 /**
  * Refuses a header name that is not an HTTP token, the way node's setHeader does and with its
  * error, so an application catching ERR_INVALID_HTTP_TOKEN behind Express catches it here.
@@ -1446,10 +1486,7 @@ const HEADER_VALUE = /[^\t\x20-\x7e\x80-\xff]/;
  */
 function validateHeaderName(name) {
     if (typeof name !== "string" || !HEADER_TOKEN.test(name)) {
-        /** @type {NodeJS.ErrnoException} */
-        const err = new TypeError(`Header name must be a valid HTTP token ["${name}"]`);
-        err.code = "ERR_INVALID_HTTP_TOKEN";
-        throw err;
+        throw headerError(`Header name must be a valid HTTP token ["${name}"]`, "ERR_INVALID_HTTP_TOKEN");
     }
 }
 
@@ -1471,10 +1508,7 @@ function validateHeaderValue(name, value) {
         return;
     }
     if (HEADER_VALUE.test(value)) {
-        /** @type {NodeJS.ErrnoException} */
-        const err = new TypeError(`Invalid character in header content ["${name}"]`);
-        err.code = "ERR_INVALID_CHAR";
-        throw err;
+        throw headerError(`Invalid character in header content ["${name}"]`, "ERR_INVALID_CHAR");
     }
 }