fulmine.js 5.12.1 → 5.12.3

package/README.md

@@ -285,6 +285,7 @@ A single-stage `node:26-trixie-slim` image works too if you `apt-get install -y
 - `app.listen()` returns the app rather than a separate server object, and the app answers as an `http.Server`: `app instanceof http.Server` is true, which is what the graceful shutdown wrappers and the connection trackers look for. There is still no node server underneath, the socket belongs to µWS, so what is answered is the surface and not the plumbing. There: `close()`, `address()`, `listening`, `getConnections()`, `ref()`, `unref()`, `setTimeout()` and the `keepAliveTimeout` family. Not there: nothing emits `connection`, `request` or `upgrade`, `getConnections()` counts the requests in flight rather than sockets, and the timeouts belong to µWS and are set through `uwsOptions.idleTimeout`. Anything that wants to serve its own protocol on the socket, socket.io being the usual case, still wants `app.uwsApp`. Runnable: [`examples/graceful-shutdown.js`](./examples/graceful-shutdown.js).
 - `x-powered-by` is disabled by default. Express sends `X-Powered-By: Express` unless you turn it off; Fulmine does not send it unless you turn it on with `app.set("x-powered-by", true)`. The header only tells anyone asking which framework is running.
 - request body is only read for POST, PUT, PATCH and QUERY requests by default. You can add additional methods by setting `body methods` to array with uppercased methods.
+- **A request whose framing cannot be trusted is refused by hanging up, with no answer at all.** Node's parser refuses each of these with a `400` and Fulmine refuses the same ones: a repeated `Content-Length`; one that is not a plain count of bytes, an empty value or a count past `Number.MAX_SAFE_INTEGER` included; a `Transfer-Encoding` whose last coding is not `chunked`; and a method nobody defines, which includes a lowercase one, since methods are case sensitive. µWS accepts all of them. It frames the request on the first length, or on no body at all, and it takes any token as a method, so `{"a":1}GET /path HTTP/1.1` is a request line to it. What the client sent as a body is then read as the next request on the connection: that is request smuggling, and a proxy in front disagreeing about the framing is all it takes. The answer differs from Express because it cannot be helped. µWS only skips the request it has already queued when the response is closed rather than completed, and writing the `400` completes it, so the choice is between telling the client and stopping the smuggled request. Nothing well behaved sends any of these.
 - **A compiled route answers `connection: keep-alive` to a client that sent `Connection: close`.** A handler simple enough to be read at registration time is answered by µWS from a response written once at `listen()`, and that response cannot read the request. The socket still closes, so what is wrong is the header and not the transport. A response that would carry a validator is never compiled, so conditional requests behave as on Express; `app.set("declarative responses", false)` turns compiling off.
 - **Informational responses go nowhere.** `res.writeEarlyHints()`, `res.writeContinue()` and `res.writeProcessing()` are all there, take what node's take and throw what node's throw once the head has gone out, but nothing reaches the wire: µWebSockets.js has no API for a `1xx`. They exist so that code written for Express keeps running rather than dying on "is not a function", which is the only thing a drop-in can honestly promise here. `res.addTrailers()` is the same story, and `res.setTimeout()` and `req.setTimeout()` register the listener without changing anything, since µWS runs its own idle timeout through `uwsOptions.idleTimeout`.
 - For HTTPS, instead of doing this:

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.12.1",
+    "version": "5.12.3",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "bin": {
@@ -28,7 +28,10 @@
         "release:local": "node tools/release-local.js",
         "cover:full": "nyc --silent npm run test && nyc --silent --no-clean npm run test:unit && nyc --silent --no-clean npm run test:express && nyc report",
         "cover:check": "nyc check-coverage --statements 94.5 --branches 90 --functions 94 --lines 94.5",
-        "examples:install": "npm --prefix examples install"
+        "examples:install": "npm --prefix examples install",
+        "fuzz:wire": "node tools/wire-fuzz.js",
+        "fuzz:headers": "node tools/header-fuzz.js",
+        "fuzz:session": "node tools/session-fuzz.js"
     },
     "engines": {
         "node": ">=22"
@@ -72,7 +75,7 @@
         "bytes": "^3.1.2",
         "compressible": "^2.0.18",
         "content-disposition": "^1.1.0",
-        "cookie": "^1.1.1",
+        "cookie": "^0.7.2",
         "cookie-signature": "^1.2.2",
         "encodeurl": "^2.0.0",
         "fast-decode-uri-component": "^1.0.1",

package/src/application.js

@@ -529,8 +529,8 @@ class Application extends Router {
     _serveGeneric(res, req) {
         const request = this.handleRequest(res, req);
         const response = request.res;
-        if (request._badFraming === true) {
-            return this._refuseFraming(response);
+        if (request._mustRefuse === true) {
+            return this._refuseRequest(response);
         }
         try {
             this._routeRequestDirect(request, response);

package/src/declarative.js

@@ -54,6 +54,11 @@ const MAX_INSTRUCTION_LENGTH = 65535;
 // so it cannot honour one, and a handler that sets one has to stay on the ordinary path.
 const VALIDATOR_HEADERS = new Set(["etag", "last-modified"]);
 
+// The statuses whose message carries no content. 205 is here for node's reason rather than
+// express's: express strips the body for 204 and 304, and node answers a 205 with a lone
+// Content-Length of zero, so all three come out of the ordinary path with no body at all.
+const BODILESS_STATUSES = new Set([204, 205, 304]);
+
 const bodyMethods = new Set(["send", "json", "end"]);
 // and the four that finish the response, after which nothing a handler does is observable
 const terminalMethods = new Set(["send", "json", "end", "sendStatus"]);
@@ -710,6 +715,17 @@ module.exports = function compileDeclarative(cb, app) {
             return false;
         }
 
+        // A status that carries no content, which is a rule about the message and not about the
+        // application: express drops the body and the framing headers for 204 and 304, and node
+        // writes a lone Content-Length: 0 for 205. Compiled, the body went out anyway, so
+        // res.sendStatus(204) answered "No Content" with a Content-Length of ten. A client frames
+        // a 204 as bodiless whatever the headers say, so those ten bytes were read as the start of
+        // the next answer on the connection, which is a desync on any keep-alive client. The
+        // ordinary path already writes all three the way express does: this hands them back to it.
+        if (BODILESS_STATUSES.has(statusCode) || statusCode < 200) {
+            return false;
+        }
+
         let decRes = new uWSAny.DeclarativeResponse();
 
         if (statusCode !== 200) {

package/src/request.js

@@ -152,6 +152,52 @@ const discardedDuplicates = new Set([
 // 128 KB of body buffered before uWS is asked to pause
 const READABLE_OPTIONS = { highWaterMark: 128 * 1024 };
 
+// The methods node's parser accepts, which is the set a request can arrive with behind Express and
+// the set a route can be registered for here. µWS accepts any token, so without this a line like
+// `{"a":1}GET /path HTTP/1.1` is a request to it, with `{"A":1}GET` as the method. See _mustRefuse.
+const KNOWN_METHODS = new Set(require("http").METHODS);
+
+/**
+ * Whether a transfer-encoding leaves the body's length knowable, which is RFC 9112's rule that
+ * `chunked` comes last. `gzip, chunked` is fine and `chunked, gzip` is not: with a coding applied
+ * after the framing one, nothing can say where the body ends, and node answers 400 rather than
+ * guess. µWS guesses, and what it guesses wrong becomes the next request on the connection.
+ *
+ * Read per header rather than over the joined value, so a request splitting the list across two
+ * transfer-encoding headers is refused even when the codings would be legal joined up. That is
+ * stricter than node by a hair, on a shape nothing sends, and stricter is the safe direction here.
+ *
+ * @param {string} value one transfer-encoding header, as uWS hands it over
+ * @returns {boolean}
+ */
+function endsWithChunked(value) {
+    const last = value.slice(value.lastIndexOf(",") + 1).trim();
+    // a coding may carry parameters, which are not part of its name
+    const semicolon = last.indexOf(";");
+    return (semicolon === -1 ? last : last.slice(0, semicolon)).trim().toLowerCase() === "chunked";
+}
+
+/**
+ * The path of the url a request carries right now, without the query.
+ *
+ * Express reads it off req.url on every access, so a middleware that assigns req.url is seen by
+ * whatever runs next, the callback after it in the same route included: the router takes a rewrite
+ * over at its next hop, and until then the field is a hop behind. `req.url = req.url.replace(/^\/+/,
+ * "/")` reported "//" for the rest of its own route where express reports "/". The field answers
+ * while the two agree, which is every read of a request nobody rewrote.
+ *
+ * @param {any} req
+ * @returns {string}
+ */
+function currentPath(req) {
+    const url = req.url;
+    if (url === req._lastUrl) {
+        return req._path;
+    }
+    const query = url.indexOf("?");
+    return query === -1 ? url : url.slice(0, query);
+}
+
 /**
  * Whether a content-length is a plain count of bytes, which is the only thing RFC 9112 allows.
  *
@@ -173,6 +219,12 @@ function isByteCount(value) {
             return false;
         }
     }
+    // A count nothing can represent is not a count. Node refuses one that overflows, and µWS framed
+    // the request as if it had said something else, which put the bytes after it in a request of
+    // their own. The length test first, so an ordinary value never parses.
+    if (value.length > 15 && Number(value) > Number.MAX_SAFE_INTEGER) {
+        return false;
+    }
     return true;
 }
 
@@ -363,11 +415,15 @@ module.exports = class Request extends LazyReadable {
             if (headerKey.length === 14) {
                 // a second content-length whatever it says, and one that is not a count of bytes:
                 // both make uWS frame the request differently from what is on the wire, see
-                // _badFraming and isByteCount
+                // _mustRefuse and isByteCount
                 if (r._sawContentLength || !isByteCount(value)) {
-                    r._badFraming = true;
+                    r._mustRefuse = true;
                 }
                 r._sawContentLength = true;
+            } else if (!endsWithChunked(value)) {
+                // chunked has to be the last coding: anything after it and the length of the body
+                // is not knowable, which node answers 400 to and µWS served. See endsWithChunked
+                r._mustRefuse = true;
             }
             // saying anything about framing at all, "0" included. A parser that can see a
             // content-length answers about the body it describes, even an empty one: a zero length
@@ -480,9 +536,9 @@ module.exports = class Request extends LazyReadable {
     _sawContentLength;
 
     /**
-     * Whether the request said two different things about how long its body is, so uWS may have
-     * framed it differently from the client that sent it and the proxy that forwarded it. Two
-     * shapes reach this, and node's parser refuses both outright:
+     * Whether this request must not be routed at all. Node's parser refuses each of these outright
+     * and answers 400; every one of them is a way for bytes the client did not send as a request to
+     * be served as one, which is request smuggling.
      *
      *   a repeated content-length     uWS frames on the first and drops the rest, so a proxy in
      *                                 front reading the last one instead forwards bytes uWS then
@@ -491,13 +547,17 @@ module.exports = class Request extends LazyReadable {
      *                                 included, and frames the request as carrying no body at all,
      *                                 which turns the body the client sent into that same second
      *                                 request. See isByteCount
+     *   a method nobody defines       uWS takes any token as the method, so anything at all
+     *                                 followed by a space and a path is a request line to it. A
+     *                                 request with no content-length and no transfer-encoding has
+     *                                 no body, so the bytes after it are the next request: node
+     *                                 reads them and answers 400, uWS served them. See KNOWN_METHODS
      *
-     * Either way it is request smuggling, and the request is refused rather than routed. Declared
-     * for the same reason as rawIp.
+     * Declared for the same reason as rawIp.
      *
      * @type {boolean|undefined}
      */
-    _badFraming;
+    _mustRefuse;
 
     /**
      * Whether the client asked for the connection to be closed. Declared for the same reason.
@@ -567,7 +627,7 @@ module.exports = class Request extends LazyReadable {
             // A content-length of "0" declares no body and used to stay on the cheap side, but
             // getHeader only ever returns the first of a repeated header, so a duplicate cannot be
             // seen from here, and a duplicate has to be refused rather than routed: see
-            // _badFraming. Anything that says a word about framing takes the full copy instead.
+            // _mustRefuse. Anything that says a word about framing takes the full copy instead.
             //
             // One shape stays invisible here, a content-length present with an empty value: uWS
             // answers "" for that and for a header that was never sent, and nothing in its API
@@ -632,7 +692,7 @@ module.exports = class Request extends LazyReadable {
         }
         if (preset) {
             // the registration's constants: two native crossings and their strings not asked for
-            this.path = preset.path;
+            this._path = preset.path;
             this.originalUrl = preset.path + this.urlQuery;
             this.url = this.originalUrl;
             this._lastUrl = this.originalUrl;
@@ -646,17 +706,27 @@ module.exports = class Request extends LazyReadable {
             // getUrl() is the path already, so the query is joined on and then not split off
             // again. Building originalUrl and picking the path back out of it with indexOf and
             // substring was a search and a second string for something uWS had just handed over.
-            this.path = req.getUrl();
-            this.originalUrl = this.path + this.urlQuery;
+            this._path = req.getUrl();
+            this.originalUrl = this._path + this.urlQuery;
             this.url = this.originalUrl;
             // what the router last wrote to req.url. A middleware assigning something else is a
             // rewrite, which express honours, and dispatch compares against this to notice it
             this._lastUrl = this.originalUrl;
             // charCodeAt rather than indexing: s[i] builds a one character string to throw away
-            this.endsWithSlash = this.path.charCodeAt(this.path.length - 1) === 0x2f;
-            this._opPath = this.path;
-            this._originalPath = this.path;
-            this.method = req.getCaseSensitiveMethod().toUpperCase();
+            this.endsWithSlash = this._path.charCodeAt(this._path.length - 1) === 0x2f;
+            this._opPath = this._path;
+            this._originalPath = this._path;
+            const rawMethod = req.getCaseSensitiveMethod();
+            this.method = rawMethod.toUpperCase();
+            // node's parser knows a fixed set and refuses everything else; µWS takes the token as
+            // it finds it, so a request line is anything with a space in it. Compared before the
+            // uppercasing on purpose: a method is case sensitive, node refuses "post", and µWS
+            // folds it to POST and serves it. Only asked of a method the framework cannot route
+            // anyway, since a route can only be registered for one of these, see the loop that
+            // builds the verb methods at the end of router.js
+            if (!KNOWN_METHODS.has(rawMethod)) {
+                this._mustRefuse = true;
+            }
             this._isOptions = this.method === "OPTIONS";
             this._isHead = this.method === "HEAD";
         }
@@ -1004,6 +1074,17 @@ module.exports = class Request extends LazyReadable {
         return index !== -1 ? header.slice(0, index).trim() : header.trim();
     }
 
+    /**
+     * The path of the current url, without the query and relative to the mount the request is in.
+     * A getter rather than a field, because express recomputes it from req.url on every read, see
+     * currentPath.
+     *
+     * @returns {string}
+     */
+    get path() {
+        return currentPath(this);
+    }
+
     /**
      * Takes over what a middleware assigned to req.url: the remaining routing matches the new
      * path, and req.query reflects the new query string. The assigned url is relative to the
@@ -1025,7 +1106,7 @@ module.exports = class Request extends LazyReadable {
         // a rewrite to "/a?" keeps its "?", as one arriving that way does
         this.urlQuery = queryIndex === -1 ? "" : "?" + this._rawQuery;
         this._originalPath = prefix + newPath;
-        this.path = newPath;
+        this._path = newPath;
         this.endsWithSlash = newPath.charCodeAt(newPath.length - 1) === 0x2f;
         this._opPath = newPath;
         this._opPathLower = null;

package/src/router.js

@@ -241,7 +241,18 @@ class Walk {
             // was one closure per hop of every request not on a compiled chain
             for (; routeIndex < routes.length; routeIndex++) {
                 const r = routes[routeIndex];
-                if (!(r.all || r.method === req.method || req._isOptions || (r.gettable && req._isHead))) {
+                // A HEAD request enters a route whose path matched even when its verb cannot serve
+                // one: express exempts HEAD from the method check ("if (!hasMethod && method !==
+                // 'HEAD')" in router/index.js), so the layer's parameters are captured and its
+                // param() callbacks run before the route is dropped. Only asked when the router has
+                // callbacks to run, since entering a route to step straight back out of it is
+                // otherwise pure cost with nothing to show for it. runRoute steps over it.
+                if (!(
+                    r.all ||
+                    r.method === req.method ||
+                    req._isOptions ||
+                    (req._isHead && (r.gettable || r.paramCallbacks.size > 0))
+                )) {
                     // taken only to fail: _preprocessRequest decodes again and turns it into the
                     // error, so the handlers of a route this request cannot run never see it
                     if (mayFailDecode && router._pathMatches(r, req) && router._paramsFailToDecode(r, req)) {
@@ -343,6 +354,13 @@ class Walk {
     runRoute(continueRoute) {
         const req = this.req;
         const route = this.route;
+        // A compiled chain walks into a mount rather than entering it, so the rule above needs
+        // saying here as well: everything after this marker is inside the mount, and a mount is
+        // stepped over while an error is in flight. Leaving the chain is what running out of it
+        // already means, and ordinary routing takes over after the mount.
+        if (route.keepMount === true && req._error) {
+            return this.dispatch(this.routes.length);
+        }
         if (route.use) {
             if (route.mountApp) {
                 // optimized chain: normal dispatch swaps req.app when it enters a mounted
@@ -473,7 +491,12 @@ class Walk {
         if (!this.skipCheck && this.skipUntil && this.skipUntil.routeKey >= route.routeKey) {
             return this.step(undefined);
         }
-        if (kind === CALLBACK_ROUTER) {
+        // A mounted router or application is stepped over while an error is in flight. Its handle
+        // takes three arguments, so express's Layer#handleError hands the error straight on without
+        // entering it: what a mount catches is what it raised itself. Entering it ran the error
+        // handlers written inside the mount, and left req.app pointing at a mounted application,
+        // whose settings then answered. A 500 carried an ETag under app.set("etag", false).
+        if (kind === CALLBACK_ROUTER && !req._error) {
             if (callback._isApplication) {
                 rememberApp(this, route, req);
                 useApp(req, callback);
@@ -514,20 +537,20 @@ class Walk {
                     if (parentMethods !== null) {
                         req._matchedMethods = parentMethods;
                     }
-                    if (req._isOptions && childMethods.size) {
+                    if (req._isOptions && childMethods.size && !req._error) {
                         // OPTIONS routing is different, it stops in the router if matched.
                         // Express answers as the router hands back, so a throw while answering,
                         // a head already written being the way, walks on to later error handlers
-                        if (!req._error) {
-                            try {
-                                router._sendOptionsReply(req, res, childMethods);
-                                return this.resolve(true);
-                            } catch (err) {
-                                return this.step(err);
-                            }
+                        try {
+                            router._sendOptionsReply(req, res, childMethods);
+                            return this.resolve(true);
+                        } catch (err) {
+                            return this.step(err);
                         }
-                        return this.resolve(false);
                     }
+                    // An error carried out of the mount is not answered by the automatic reply, and
+                    // stopping here handed it to the default page: express walks on to the error
+                    // handlers written after the mount, for OPTIONS as for any other method.
                     this.step(undefined);
                 })
                 // a rejection out of the nested walk, or a throw above, must reject this one
@@ -550,6 +573,11 @@ class Walk {
                     }
                     return this.step(undefined);
                 }
+                // entered only so its param callbacks could run, see the scan in dispatch: the verb
+                // cannot serve a HEAD, so nothing here answers it
+                if (req._isHead && !route.all && !route.gettable && route.method !== "HEAD") {
+                    return this.step(undefined);
+                }
 
                 const out = callback(req, res, this.next);
                 if (out instanceof Promise) {
@@ -667,10 +695,54 @@ function setMountedPath(req) {
     req._opPath = req._consumed === 0 ? req._originalPath : req._originalPath.slice(req._consumed);
     req._opPathLower = null;
     req.url = req._opPath === "" ? "/" + req.urlQuery : req._opPath + req.urlQuery;
-    req.path = req._opPath === "" ? "/" : req._opPath;
+    req._path = req._opPath === "" ? "/" : req._opPath;
     req._lastUrl = req.url;
 }
 
+// req.path as the request class declares it, taken off the prototype rather than written out a
+// second time. A request the router adopts is a plain object and gets it defined on itself, see
+// adoptPlainRequest. Enumerable, as express's own is.
+const PATH_PROPERTY = {
+    .../** @type {PropertyDescriptor} */ (Object.getOwnPropertyDescriptor(Request.prototype, "path")),
+    enumerable: true
+};
+
+const NO_PARAM_NAMES = [];
+
+/**
+ * The parameter names a route captures with its own pattern.
+ *
+ * This is the set express runs param callbacks for. A name that reached req.params from a mount
+ * above, through mergeParams, belongs to that mount's router and not to this one, and express does
+ * not call this router's param() for it: it walks the keys the layer itself matched. Reading
+ * req.params instead ran a callback for every inherited name too, which is visible whenever such a
+ * callback does anything, and turned a 200 into a 500 when one of them refused the value.
+ *
+ * Worked out once per route and kept, since it follows from the pattern and never changes.
+ *
+ * @param {any} route
+ * @returns {string[]}
+ */
+function ownParamNames(route) {
+    let names = route._ownParamNames;
+    if (names !== undefined) {
+        return names;
+    }
+    if (route.optimizedParams) {
+        // µWS matched the pattern and hands the values back by position, under these names
+        names = route.optimizedParams;
+    } else if (route.pattern instanceof RegExp) {
+        const meta = getPatternMeta(route.pattern);
+        // outputNames is what _extractParams writes into params; a RegExp the application wrote
+        // itself was never compiled here, so its capture groups are the names
+        names = meta ? meta.outputNames : regexpGroupKeys(route.pattern);
+    } else {
+        names = NO_PARAM_NAMES;
+    }
+    route._ownParamNames = names;
+    return names;
+}
+
 /**
  * Whether this route reads the parameters of the mounts above it, which is its own router asking
  * for them. The stack holds what a mergeParams router captured on the way in, and a plain router
@@ -778,7 +850,10 @@ function adoptPlainRequest(req, router) {
     const path = queryIndex === -1 ? raw : raw.slice(0, queryIndex);
     req.urlQuery = queryIndex === -1 ? "" : raw.slice(queryIndex);
     req._rawQuery = req.urlQuery.slice(1);
-    req.path = path;
+    req._path = path;
+    // an adopted request is a plain object, so it carries no prototype of ours and reads its path
+    // off a property of its own. The class's getter itself, so there is one of it
+    Object.defineProperty(req, "path", PATH_PROPERTY);
     req.originalUrl = req.originalUrl ?? arrived;
     req._originalPath = path;
     req.endsWithSlash = path.charCodeAt(path.length - 1) === 0x2f;
@@ -1796,6 +1871,16 @@ module.exports = class Router extends EventEmitter {
                 }
             }
 
+            // The same rule as the one just above, which a route of another method reaches by
+            // another road. A mount's chain is inherited by every path under it, and a route that
+            // is not itself a mount answers the mount point rather than the subtree: in the chain
+            // it ran for the whole of it, so router.all("/:p1") answered the /posts/a-b that
+            // belongs to the router mounted at /posts. guardsInside is written for this: only
+            // layers with more segments than the mount path are asked about a leaf.
+            if (route.use && !r.use && typeof route.path === "string" && couldAnswer(r, route.path)) {
+                return false;
+            }
+
             // a RegExp mount runs only where its match starts the path and breaks on a separator,
             // which is decidable here against a literal path and not against one with a parameter
             if (r.regexMount) {
@@ -1822,13 +1907,9 @@ module.exports = class Router extends EventEmitter {
 
             // check if the paths match. A route with parameters is excluded from the text test:
             // its literal ":name" text would let an earlier regex in on requests it never matches.
-            // Both spellings of this route's path are tried, because without strict routing it
-            // answers "/x/" as well as "/x", and an earlier pattern that matches only the first is
-            // still an earlier pattern that answers a request this registration would take.
+            const regexCanMatch = r.pattern instanceof RegExp && (!withParams || r.use);
             if (
-                (r.pattern instanceof RegExp &&
-                    (!withParams || r.use) &&
-                    (r.pattern.test(route.path) || (!strictHere && r.pattern.test(route.path + "/")))) ||
+                (regexCanMatch && r.pattern.test(route.path)) ||
                 (typeof r.pattern === "string" &&
                     (r.pattern === route.path ||
                         (!caseSensitive && r.pattern.toLowerCase() === routePathFolded) ||
@@ -1840,6 +1921,15 @@ module.exports = class Router extends EventEmitter {
                 optimizedPath.push(r);
                 continue;
             }
+            // Without strict routing this registration answers "/x/" as well as "/x". An earlier
+            // pattern matching only the second answers part of what the registration takes and not
+            // the rest, which the chain has no way to say: it runs what is in it without matching
+            // again. Both spellings used to put the route in whole, so app.all("/:p0/{:o1}/{:o2}")
+            // answered a GET /list/Mixed that belonged to the route written after it. An ordinary
+            // pattern answers both spellings, so only an optional group or a wildcard reaches here.
+            if (regexCanMatch && !strictHere && r.pattern.test(route.path + "/")) {
+                return false;
+            }
             if (!withParams) {
                 continue;
             }
@@ -1899,6 +1989,13 @@ module.exports = class Router extends EventEmitter {
         if (!this.uwsApp) {
             return;
         }
+        // Everything below is what makes this framework fast, and every one of its decisions is a
+        // claim that µWS answering by itself is the same answer the chain would have given. Turned
+        // off, the claim is not made and the chain answers everything. Serving one application both
+        // ways and comparing the answers is what tests those claims: `npm run fuzz -- --self`.
+        if (this.get("native routes") === false) {
+            return;
+        }
 
         // pathPrefix/chainPrefix accumulate across nested sole-callback mounts, and outerGuards
         // carries what was written before them and answers only part of what is under them
@@ -2083,7 +2180,7 @@ module.exports = class Router extends EventEmitter {
      *
      * @param {any} response
      */
-    _refuseFraming(response) {
+    _refuseRequest(response) {
         response.finished = true;
         response._res.close();
         response.emit("close");
@@ -2195,8 +2292,8 @@ module.exports = class Router extends EventEmitter {
                 }
                 const request = this.handleRequest(res, req, preset, skipHolder);
                 const response = request.res;
-                if (request._badFraming === true) {
-                    return this._refuseFraming(response);
+                if (request._mustRefuse === true) {
+                    return this._refuseRequest(response);
                 }
                 if (optimizedParams) {
                     request.optimizedParams = new NullObject();
@@ -2295,6 +2392,10 @@ module.exports = class Router extends EventEmitter {
             route.callbacks.length === 1 && // must not have multiple callbacks
             typeof route.callbacks[0] === "function" && // must be a function
             route.paramCallbacks.size === 0 && // a param callback has to run, and this answers without running anything
+            // a captured value is decoded when the route runs, and one that cannot be decoded is a
+            // 400 in express and on the ordinary path here. Nothing runs to raise it on a
+            // declarative response, so GET /a-b%5Ec@d%e came back 200 from app.get("/:p12")
+            route.optimizedParams === undefined &&
             // a declarative response is answered by µWS itself, so no javascript runs and the case
             // guard could not: a route that needs one has to stay an ordinary handler
             caseGuards === null &&
@@ -2514,8 +2615,14 @@ module.exports = class Router extends EventEmitter {
 
         // the route's own router's callbacks: an optimized chain is walked by the app even when it
         // ends in a mounted router's route
+        //
+        // A route an OPTIONS request reaches only to have its verb counted for the automatic reply
+        // is not a route this request runs, and express does not run its app.param() callbacks for
+        // it. The same condition runRoute counts the verb under, see the OPTIONS branch there. The
+        // decoding above still happens either way, because express decodes a layer whose path
+        // matched whatever its method is, which is what answers 400 for a malformed escape.
         const paramCallbacks = route.paramCallbacks;
-        if (paramCallbacks.size > 0) {
+        if (paramCallbacks.size > 0 && !(req._isOptions && !route.all && route.method !== "OPTIONS")) {
             return this._runParamCallbacks(req, res, route, paramCallbacks);
         }
         return true;
@@ -2558,9 +2665,14 @@ module.exports = class Router extends EventEmitter {
      * @returns {Promise<true|"route">|true}
      */
     _runParamCallbacks(req, res, route, paramCallbacks) {
+        // the names this route captured itself, not everything in req.params: a merged-in name
+        // belongs to the mount that captured it, see ownParamNames
         let names;
-        for (const name in req.params) {
-            if (paramCallbacks.has(name)) {
+        const own = ownParamNames(route);
+        for (let i = 0; i < own.length; i++) {
+            const name = own[i];
+            // an optional group that did not match leaves no parameter to call anything for
+            if (paramCallbacks.has(name) && req.params[name] !== undefined) {
                 (names ??= []).push(name);
             }
         }

package/src/utils.js

@@ -409,8 +409,21 @@ function patternToRegex(pattern, isPrefix = false, caseSensitive = true, strict
             // splits /a.b.c against /:file{.:ext} as file=a.b, ext=c, which only works if ext
             // cannot contain a dot. After static text there is nothing to give ground, so the
             // parameter takes everything: /file{.:ext} against /file.tar.gz gives ext=tar.gz.
-            const separator = lastTokenWasParam && groupContent[0] && groupContent[0] !== ":" ? groupContent[0] : "";
-            const groupParamClass = `[^/${separator.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}]+`;
+            // The whole of it, not its first character: /:foo{abc:bar} against /123abcabc splits as
+            // foo=123 and bar=abc on express, and reading the separator as "a" left bar unable to
+            // match its own text, so the group never matched and foo took the segment whole. More
+            // than one character cannot go in a class, so it is written as a lookahead, and either
+            // way the parameter is still allowed to be exactly the separator, as path-to-regexp
+            // writes it.
+            const colon = groupContent.indexOf(":");
+            const separator = lastTokenWasParam && colon > 0 ? groupContent.slice(0, colon) : "";
+            const escapedSeparator = separator.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const groupParamClass =
+                separator === ""
+                    ? "[^/]+"
+                    : separator.length === 1
+                      ? `[^/${escapedSeparator}]+|${escapedSeparator}`
+                      : `(?:(?!${escapedSeparator})[^/])+|${escapedSeparator}`;
 
             let groupRegex = "";
             let gi = 0;
@@ -596,13 +609,23 @@ function canBeOptimizedWithParams(pattern) {
     return true;
 }
 
+// What makes a segment something other than the text it is written as: a parameter, a wildcard, an
+// optional group, or an escape. Only two plain literals can prove that two paths never meet, so
+// anything carrying one of these has to be read as "could be anything".
+const NOT_A_LITERAL = /[:*{}\\]/;
+
 /**
  * Whether two paths could both match the same request.
  *
- * Only asked about paths µWS could match itself, so the answer is structural: the same number of
- * segments, and no position where two different literals meet. `/orders/:id` and `/invoices/:id`
- * cannot both match, `/users/:id` and `/users/me` can. Anything else is not asked, and the caller
- * reads "do not know" as yes.
+ * The answer is structural: no position where two different literals meet, and, when neither path
+ * can change length, the same number of segments. `/orders/:id` and `/invoices/:id` cannot both
+ * match, `/users/:id` and `/users/me` can. The caller reads "do not know" as yes, so every doubt
+ * answers true: saying two paths overlap only costs a native registration, while missing one lets
+ * µWS answer a request that belonged to an earlier route.
+ *
+ * A parameter is not the only shape that matches more than itself. A wildcard and an optional group
+ * do too, and reading `{:opt}` or `*splat` as the literal text it is written as reported "cannot
+ * overlap" for a route that plainly could, which took the earlier route's turn away.
  *
  * @param {string} a
  * @param {string} b
@@ -612,15 +635,19 @@ function canBeOptimizedWithParams(pattern) {
 function pathsCanOverlap(a, b, aIsPrefix = false) {
     const left = a.split("/");
     const right = b.split("/");
-    if (aIsPrefix ? left.length > right.length : left.length !== right.length) {
+    // An optional group matches its segment or nothing at all and a wildcard matches several, so a
+    // path carrying either one matches more than one length and the count settles nothing.
+    const fixedLength =
+        a.indexOf("{") === -1 && b.indexOf("{") === -1 && a.indexOf("*") === -1 && b.indexOf("*") === -1;
+    if (fixedLength && (aIsPrefix ? left.length > right.length : left.length !== right.length)) {
         return false;
     }
-    for (let i = 0; i < left.length; i++) {
+    const shared = left.length < right.length ? left.length : right.length;
+    for (let i = 0; i < shared; i++) {
         if (left[i] === right[i]) {
             continue;
         }
-        // a parameter matches whatever is in that segment, so only two different literals settle it
-        if (left[i].charCodeAt(0) === 0x3a || right[i].charCodeAt(0) === 0x3a) {
+        if (NOT_A_LITERAL.test(left[i]) || NOT_A_LITERAL.test(right[i])) {
             continue;
         }
         return false;
@@ -947,6 +974,13 @@ const defaultSettings = {
     // The native µWS router matches bytes, so the compiler in _compileOptimizedRoutes only hands
     // it routes whose earlier siblings it can prove agree under either case rule.
     "declarative responses": true,
+    // on. Off hands every request to the ordinary chain instead of letting µWS match what it can,
+    // which is slower and answers the same. Not a tuning knob: it exists so one application can be
+    // served both ways and the two sets of answers compared, which tests the optimizer against the
+    // rest of the framework without a second framework to compare with. See
+    // `npm run fuzz -- --self`. A compiled response needs a native registration to hang on, so this
+    // takes "declarative responses" with it.
+    "native routes": true,
     // off: with a window set, the size and mtime of a file served by sendFile are remembered for
     // it, which is one syscall less per request and a file that can be served as it was a moment
     // ago. "stat cache ms" is the window in milliseconds, compiled from it by set()
@@ -1436,6 +1470,32 @@ function withUtf8Charset(value) {
 const HEADER_TOKEN = /^[\^_`a-zA-Z\-0-9!#$%&'*+.|~]+$/;
 const HEADER_VALUE = /[^\t\x20-\x7e\x80-\xff]/;
 
+/**
+ * One of node's header errors, built the way node builds it.
+ *
+ * Assigning the code is not the whole of it. Node also puts the code in the first line of the
+ * stack, by naming the error "TypeError [THE_CODE]" while V8 formats that line and then taking
+ * the name back off. Whatever prints a stack therefore says which code it was, and the default
+ * error page prints exactly that: without this, the same refusal reads "TypeError:" here and
+ * "TypeError [ERR_INVALID_CHAR]:" behind Express. Found by fuzzing against express.
+ *
+ * @param {string} message
+ * @param {string} code
+ * @returns {NodeJS.ErrnoException}
+ */
+function headerError(message, code) {
+    /** @type {NodeJS.ErrnoException} */
+    const err = new TypeError(message);
+    err.name = `TypeError [${code}]`;
+    // reading it is what makes V8 format the line, and it formats it from the name above
+    void err.stack;
+    // back to the prototype's "TypeError", which is what node leaves behind. Cast because Error
+    // declares name as always present, and this deletes the own property to uncover it again
+    delete (/** @type {any} */ (err).name);
+    err.code = code;
+    return err;
+}
+
 /**
  * Refuses a header name that is not an HTTP token, the way node's setHeader does and with its
  * error, so an application catching ERR_INVALID_HTTP_TOKEN behind Express catches it here.
@@ -1446,10 +1506,7 @@ const HEADER_VALUE = /[^\t\x20-\x7e\x80-\xff]/;
  */
 function validateHeaderName(name) {
     if (typeof name !== "string" || !HEADER_TOKEN.test(name)) {
-        /** @type {NodeJS.ErrnoException} */
-        const err = new TypeError(`Header name must be a valid HTTP token ["${name}"]`);
-        err.code = "ERR_INVALID_HTTP_TOKEN";
-        throw err;
+        throw headerError(`Header name must be a valid HTTP token ["${name}"]`, "ERR_INVALID_HTTP_TOKEN");
     }
 }
 
@@ -1471,10 +1528,7 @@ function validateHeaderValue(name, value) {
         return;
     }
     if (HEADER_VALUE.test(value)) {
-        /** @type {NodeJS.ErrnoException} */
-        const err = new TypeError(`Invalid character in header content ["${name}"]`);
-        err.code = "ERR_INVALID_CHAR";
-        throw err;
+        throw headerError(`Invalid character in header content ["${name}"]`, "ERR_INVALID_CHAR");
     }
 }