fulmine.js 5.15.0 → 5.15.1

package/README.md

@@ -296,6 +296,10 @@ A single-stage `node:26-trixie-slim` image works too if you `apt-get install -y
 
 ## Differences from Express
 
+What the two servers answer on the wire, probed from outside, malformed input and smuggling
+attempts included: [fulmine.js on http-probe.com](https://www.http-probe.com/servers/fulmine-js.html)
+against [express](https://www.http-probe.com/servers/express.html).
+
 - `app.listen()` returns the app rather than a separate server object, and the app answers as an `http.Server`: `app instanceof http.Server` is true, which is what the graceful shutdown wrappers and the connection trackers look for. There is still no node server underneath, the socket belongs to µWS, so what is answered is the surface and not the plumbing. There: `close()`, `address()`, `listening`, `getConnections()`, `ref()`, `unref()`, `setTimeout()` and the `keepAliveTimeout` family. Not there: nothing emits `connection`, `request` or `upgrade`, `getConnections()` counts the requests in flight rather than sockets, and the timeouts belong to µWS and are set through `uwsOptions.idleTimeout`. Anything that wants to serve its own protocol on the socket, socket.io being the usual case, still wants `app.uwsApp`. Runnable: [`examples/graceful-shutdown.js`](./examples/graceful-shutdown.js).
 - `x-powered-by` is disabled by default. Express sends `X-Powered-By: Express` unless you turn it off; Fulmine does not send it unless you turn it on with `app.set("x-powered-by", true)`. The header only tells anyone asking which framework is running.
 - request body is only read for POST, PUT, PATCH and QUERY requests by default. You can add additional methods by setting `body methods` to array with uppercased methods.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.15.0",
+    "version": "5.15.1",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "exports": {

package/src/middlewares.js

@@ -29,6 +29,20 @@ const qs = require("qs");
 const parseQuery = require("./parse-query.js");
 const { kGetSafe } = require("./usage.js");
 const { AsyncResource } = require("async_hooks");
+
+/**
+ * What AsyncResource.bind answers, without node's generic wrapper: that one builds a rest-args
+ * closure and defines properties onto it per call, ~1.9us on this node, where the resource plus
+ * an arrow through runInAsyncScope restores the same context for ~0.08. The type keeps the bound
+ * function's name, as node's does.
+ *
+ * @param {(...args: any[]) => any} fn called with at most one argument by every caller here
+ * @returns {(err?: any) => any}
+ */
+function bindContext(fn) {
+    const resource = new AsyncResource(fn.name || "bound-anonymous-fn");
+    return (err) => resource.runInAsyncScope(fn, undefined, err);
+}
 const {
     fastQueryParse,
     NullObject,
@@ -758,7 +772,7 @@ function serveStatic(root, options) {
         return res.sendFile(
             _path,
             options,
-            AsyncResource.bind((e) => {
+            bindContext((e) => {
                 if (e) {
                     next(options.fallthrough && FALLTHROUGH_STATUSES.has(e.status) ? undefined : e);
                 }
@@ -911,12 +925,14 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             }
 
             const length = req._rawHeader("content-length");
+            // converted once: four sites read this number on the fast path
+            const lengthNumber = length === undefined ? NaN : +length;
 
             // No content-length and no transfer-encoding means the request carries no body at all,
             // and a body parser must leave it alone rather than parse nothing into an empty value.
             // type-is applies this before matching the type, but the simpleType shortcut below
             // compares strings directly and would otherwise skip the check.
-            if (req._rawHeader("transfer-encoding") === undefined && isNaN(length)) {
+            if (req._rawHeader("transfer-encoding") === undefined && Number.isNaN(lengthNumber)) {
                 return next();
             }
 
@@ -960,7 +976,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             // {} for json and urlencoded, '' for text, an empty Buffer for raw - rather than leaving
             // req.body as the placeholder object. there is nothing to read, so run the tail directly,
             // and the verify hook still runs first: webhook signature checks rely on that
-            if (Number(length) === 0) {
+            if (lengthNumber === 0) {
                 req.bodyRead = true;
                 const empty = Buffer.alloc(0);
                 if (!runVerify(req, res, next, options, empty)) {
@@ -969,12 +985,12 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                 return beforeReturn(req, res, next, options, empty, encoding);
             }
 
-            // skip reading too large body
-            if (length && +length > limit) {
+            // skip reading too large body; NaN compares false, so no declared length passes
+            if (lengthNumber > limit) {
                 return next(
                     bodyError("request entity too large", 413, "entity.too.large", {
-                        expected: +length,
-                        length: +length,
+                        expected: lengthNumber,
+                        length: lengthNumber,
                         limit: limit
                     })
                 );
@@ -1024,7 +1040,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             // From here the body really gets read, and uWS delivers it on native callbacks that
             // carry no async context, so this is the one continuation that has to be bound: an
             // upstream middleware's AsyncLocalStorage must still be there when next runs
-            next = AsyncResource.bind(next);
+            next = bindContext(next);
 
             // with nothing to decompress, uWS can collect the whole body in native code: one
             // callback instead of one per chunk, the limit enforced before any byte reaches JS,
@@ -1032,8 +1048,8 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             // returns, so a view over uWS's own memory is enough. A declared length was the
             // original case; a chunked body accumulates in the same native vector and only loses
             // the length check, since there is no declaration to hold it to
-            const declared = Number(length);
-            const declaresLength = !isNaN(declared) && declared > 0;
+            const declared = lengthNumber;
+            const declaresLength = !Number.isNaN(declared) && declared > 0;
             if (!req.receivedData && !inflate && req._res.collectBody && (declaresLength || isNaN(declared))) {
                 req.bodyRead = true;
                 req._res.collectBody(limit, (body) => {
@@ -1358,50 +1374,58 @@ const urlencoded = createBodyParser(
     function (req, res, next, options, buf, encoding) {
         try {
             const body = decodeBody(buf, encoding);
-            const count = parameterCount(body, options.parameterLimit);
-            if (count === undefined) {
-                return next(bodyError("too many parameters", 413, "parameters.too.many"));
-            }
             // Express 5 defaults extended to false, so nested keys need opting in
             const extended = typeof options.extended !== "undefined" ? options.extended : false;
             // qs has to know the charset itself for anything but utf-8, and the sentinel options
             // change what a parse means, so those bodies skip the fast parsers
             const needsQs = encoding !== "utf-8" || options.charsetSentinel || options.interpretNumericEntities;
-            if (extended) {
-                // the ceiling body-parser gives qs: the array limit rises to the parameter count,
-                // so a form posting 150 array members still yields an array. count counts "&"
-                // separators where body-parser counts parameters, hence the + 1
-                const qsOptions = {
-                    ...EXTENDED_QS_OPTIONS,
-                    depth: options.depth !== undefined ? options.depth : 32,
-                    arrayLimit: Math.max(100, count + 1),
-                    charsetSentinel: options.charsetSentinel,
-                    interpretNumericEntities: options.interpretNumericEntities,
-                    charset: encoding,
-                    parameterLimit: options.parameterLimit
-                };
-                req.body = needsQs
-                    ? Object.assign(Object.create(null), qs.parse(body, qsOptions))
-                    : fastQueryParse(body, qsOptions);
-            } else if (needsQs) {
-                // body-parser's extended: false is still qs, with depth 0 and the count as the
-                // array ceiling; only qs decodes latin1 percent escapes as latin1
-                req.body = Object.assign(
-                    Object.create(null),
-                    qs.parse(body, {
-                        allowPrototypes: true,
-                        arrayLimit: count + 1,
-                        depth: 0,
-                        strictDepth: true,
+            if (!extended && !needsQs) {
+                // the vendored parser, so an urlencoded body inspects like req.query does. The
+                // parameter limit is enforced inside its scan, so the body is not walked twice;
+                // assigned only when it held, so an overflow leaves req.body the placeholder
+                const parsed = parseQuery(body, undefined, options.parameterLimit);
+                if (parseQuery.overflow === true) {
+                    return next(bodyError("too many parameters", 413, "parameters.too.many"));
+                }
+                req.body = parsed;
+            } else {
+                const count = parameterCount(body, options.parameterLimit);
+                if (count === undefined) {
+                    return next(bodyError("too many parameters", 413, "parameters.too.many"));
+                }
+                if (extended) {
+                    // the ceiling body-parser gives qs: the array limit rises to the parameter
+                    // count, so a form posting 150 array members still yields an array. count
+                    // counts "&" separators where body-parser counts parameters, hence the + 1
+                    const qsOptions = {
+                        ...EXTENDED_QS_OPTIONS,
+                        depth: options.depth !== undefined ? options.depth : 32,
+                        arrayLimit: Math.max(100, count + 1),
                         charsetSentinel: options.charsetSentinel,
                         interpretNumericEntities: options.interpretNumericEntities,
                         charset: encoding,
                         parameterLimit: options.parameterLimit
-                    })
-                );
-            } else {
-                // the vendored parser, so an urlencoded body inspects like req.query does
-                req.body = parseQuery(body);
+                    };
+                    req.body = needsQs
+                        ? Object.assign(Object.create(null), qs.parse(body, qsOptions))
+                        : fastQueryParse(body, qsOptions);
+                } else {
+                    // body-parser's extended: false is still qs, with depth 0 and the count as
+                    // the array ceiling; only qs decodes latin1 percent escapes as latin1
+                    req.body = Object.assign(
+                        Object.create(null),
+                        qs.parse(body, {
+                            allowPrototypes: true,
+                            arrayLimit: count + 1,
+                            depth: 0,
+                            strictDepth: true,
+                            charsetSentinel: options.charsetSentinel,
+                            interpretNumericEntities: options.interpretNumericEntities,
+                            charset: encoding,
+                            parameterLimit: options.parameterLimit
+                        })
+                    );
+                }
             }
         } catch (e) {
             // qs reports a depth overflow as a RangeError with its own wording; body-parser

package/src/parse-query.js

@@ -34,17 +34,30 @@ const plusRegex = /\+/g;
  * node's querystring.parse semantics on a null-prototype result: repeated keys accumulate into
  * arrays, '+' is a space, percent sequences decode when present and stay literal when broken.
  *
+ * `capture` collects the decoded pairs flat, key then value, so a caller can replay the stores
+ * without scanning again; a repeated key marks it invalid instead. See `get query`.
+ *
+ * `separatorLimit` refuses a body with that many "&" separators the way body-parser's
+ * parameterCount does, but inside this scan instead of a scan of its own: the overflow flag on
+ * the function is set, the partial result is to be discarded, and the caller answers 413.
+ *
  * @param {string} input
+ * @param {string[] & {invalid?: boolean}} [capture]
+ * @param {number} [separatorLimit]
  * @returns {Record<string, string | string[]>}
  */
-function parseQuery(input) {
+function parseQuery(input, capture, separatorLimit) {
     const result = Object.create(null);
+    if (separatorLimit !== undefined) {
+        parseQuery.overflow = false;
+    }
 
     if (typeof input !== "string") {
         return result;
     }
 
     const inputLength = input.length;
+    let separators = 0;
     let key;
     let value = "";
     let startingIndex = -1;
@@ -62,6 +75,12 @@ function parseQuery(input) {
 
         // '&' or the end of the input closes the current pair
         if (c === 38) {
+            // real separators only, not the synthetic closing one, counted exactly as
+            // parameterCount counts them
+            if (i !== inputLength && separatorLimit !== undefined && ++separators === separatorLimit) {
+                parseQuery.overflow = true;
+                return result;
+            }
             hasBothKeyValuePair = equalityIndex > startingIndex;
 
             // the equality index doubles as the end of the key when there was no '='
@@ -92,7 +111,13 @@ function parseQuery(input) {
                 const currentValue = result[key];
                 if (currentValue === undefined) {
                     result[key] = value;
+                    if (capture !== undefined) {
+                        capture.push(key, value);
+                    }
                 } else {
+                    if (capture !== undefined) {
+                        capture.invalid = true;
+                    }
                     // value.pop is cheaper than Array.isArray here, as upstream measured
                     if (currentValue.pop) {
                         currentValue.push(value);
@@ -134,4 +159,7 @@ function parseQuery(input) {
     return result;
 }
 
+// whether the last limited call hit its separator limit, see the parameter's doc
+parseQuery.overflow = false;
+
 module.exports = parseQuery;

package/src/request.js

@@ -229,6 +229,13 @@ function endsWithChunked(value) {
  * @returns {boolean}
  */
 function saysClose(value) {
+    // what clients actually send, almost always: two interned compares answer before the scan
+    if (value === "keep-alive") {
+        return false;
+    }
+    if (value === "close") {
+        return true;
+    }
     const length = value.length;
     let at = 0;
     while (at < length) {
@@ -662,6 +669,19 @@ module.exports = class Request extends LazyReadable {
      */
     noEtag;
 
+    /**
+     * The decoded pairs of the first default-parser parse of req.query, flat key,value; false
+     * when it saw a repeated key, which a flat replay cannot reproduce. See `get query`.
+     * @type {string[]|false|undefined}
+     */
+    _querySnap;
+
+    /**
+     * The raw string _querySnap came from: a url rewrite replaces _rawQuery.
+     * @type {string|undefined}
+     */
+    _querySnapRaw;
+
     /**
      * Built for every request, which is why so little happens here. The headers are copied out
      * because uWS only lends them for this call, everything derived from them waits until something
@@ -681,23 +701,24 @@ module.exports = class Request extends LazyReadable {
         super();
         this._res = res;
         this._req = req;
-        // the plain field behind the `readable` accessor, written rather than set so a request that
-        // never streams never builds a stream
-        this._readableFlag = true;
         if (skipHolder !== undefined && skipHolder.skipHeaders) {
             // The chain behind this registration provably never reads a header, so instead of
-            // copying them all out of uWS the constructor asks for the four that steer the
-            // framework itself: body framing, keep-alive, and accept for the error page a
-            // throw could still need. A GET that does declare a body is the rare case, and
-            // the parsers and the stream want the whole picture, so it takes the full copy.
+            // copying them all out of uWS the constructor asks for the ones that steer the
+            // framework itself: body framing, keep-alive, and the conditional pair. A GET that
+            // does declare a body is the rare case, and the parsers and the stream want the
+            // whole picture, so it takes the full copy.
             //
-            // Seven named reads against one forEach looks like it should lose, and does not: the
-            // seven are flat at 0.75us however many headers are on the wire, since each one is a
-            // napi crossing and the scan behind it is nothing, while the copy pays a hop back into
-            // JS per header and grows, 1.16us at four headers, 1.61 at eight, 2.90 at sixteen. They
-            // do not cross, and the gap widens exactly where real traffic lives, since a browser
-            // sends a dozen or more. The body case pays two of the seven and then copies anyway,
-            // which is 0.2us on a request that is about to read a body.
+            // A handful of named reads against one forEach looks like it should lose, and does
+            // not: measured at seven reads they were flat at 0.75us however many headers are on
+            // the wire, since each one is a napi crossing and the scan behind it is nothing,
+            // while the copy pays a hop back into JS per header and grows, 1.16us at four
+            // headers, 1.61 at eight, 2.90 at sixteen. They do not cross, and the gap widens
+            // exactly where real traffic lives, since a browser sends a dozen or more. The body
+            // case pays two reads and then copies anyway, which is 0.2us on a request that is
+            // about to read a body.
+            //
+            // accept is not read: nothing on a granted chain consumes it, the error and 404
+            // pages are fixed HTML that never negotiate.
             const length = req.getHeader("content-length");
             const transferEncoding = req.getHeader("transfer-encoding");
             // A content-length of "0" declares no body and used to stay on the cheap side, but
@@ -724,12 +745,8 @@ module.exports = class Request extends LazyReadable {
                         this._connectionClose = true;
                     }
                 }
-                const accept = req.getHeader("accept");
-                if (accept !== "") {
-                    entries.push("accept", accept);
-                }
                 // send consults freshness whatever the etag setting: if-none-match can be "*"
-                // and a handler may set a validator by hand, so the conditional trio has to be
+                // and a handler may set a validator by hand, so the conditional pair has to be
                 // really absent rather than merely uncopied
                 const ifNoneMatch = req.getHeader("if-none-match");
                 if (ifNoneMatch !== "") {
@@ -739,9 +756,13 @@ module.exports = class Request extends LazyReadable {
                 if (ifModifiedSince !== "") {
                     entries.push("if-modified-since", ifModifiedSince);
                 }
-                const cacheControl = req.getHeader("cache-control");
-                if (cacheControl !== "") {
-                    entries.push("cache-control", cacheControl);
+                // fresh() answers false before it reads cache-control unless a conditional
+                // arrived, so the read only pays on the requests that can use it
+                if (ifNoneMatch !== "" || ifModifiedSince !== "") {
+                    const cacheControl = req.getHeader("cache-control");
+                    if (cacheControl !== "") {
+                        entries.push("cache-control", cacheControl);
+                    }
                 }
             }
         } else {
@@ -802,18 +823,26 @@ module.exports = class Request extends LazyReadable {
             this._opPath = this._path;
             this._originalPath = this._path;
             const rawMethod = req.getCaseSensitiveMethod();
-            this.method = rawMethod.toUpperCase();
-            // node's parser knows a fixed set and refuses everything else; µWS takes the token as
-            // it finds it, so a request line is anything with a space in it. Compared before the
-            // uppercasing on purpose: a method is case sensitive, node refuses "post", and µWS
-            // folds it to POST and serves it. Only asked of a method the framework cannot route
-            // anyway, since a route can only be registered for one of these, see the loop that
-            // builds the verb methods at the end of router.js
-            if (!KNOWN_METHODS.has(rawMethod)) {
-                this._mustRefuse = true;
+            if (skipHolder !== undefined && rawMethod === skipHolder.method) {
+                // the registration's constant, byte for byte; any other spelling, "get" that µWS
+                // folded here included, takes the full check below
+                this.method = rawMethod;
+                this._isOptions = skipHolder.isOptions;
+                this._isHead = skipHolder.isHead;
+            } else {
+                this.method = rawMethod.toUpperCase();
+                // node's parser knows a fixed set and refuses everything else; µWS takes the token
+                // as it finds it, so a request line is anything with a space in it. Compared before
+                // the uppercasing on purpose: a method is case sensitive, node refuses "post", and
+                // µWS folds it to POST and serves it. Only asked of a method the framework cannot
+                // route anyway, since a route can only be registered for one of these, see the loop
+                // that builds the verb methods at the end of router.js
+                if (!KNOWN_METHODS.has(rawMethod)) {
+                    this._mustRefuse = true;
+                }
+                this._isOptions = this.method === "OPTIONS";
+                this._isHead = this.method === "HEAD";
             }
-            this._isOptions = this.method === "OPTIONS";
-            this._isHead = this.method === "HEAD";
         }
         // what the router last saw as the method. A middleware assigning another one is a rewrite,
         // which express honours because it reads req.method at every layer, and dispatch compares
@@ -839,9 +868,6 @@ module.exports = class Request extends LazyReadable {
         // null for the same reason as the two above: a request that never enters a mount never
         // needs either array, and the push sites materialize them
         this._stack = null;
-        // how many characters of _originalPath the mounts entered so far have taken, which is
-        // where baseUrl ends and the path below them begins
-        this._consumed = 0;
         // whether one of them took a trailing slash, which only a RegExp mount can: see baseUrl
         this._mountSlash = false;
         this._paramStack = null;
@@ -1039,7 +1065,11 @@ module.exports = class Request extends LazyReadable {
         // slash, a registered path having had it removed, so almost every request answers above.
         let out = "";
         let at = 0;
-        for (const taken of this._stack) {
+        for (let taken of this._stack) {
+            // negative marks a mount that consumed the whole path, see the push in runRoute
+            if (taken < 0) {
+                taken = -taken;
+            }
             const piece = this._originalPath.slice(at, at + taken);
             at += taken;
             out += piece.charCodeAt(taken - 1) === 0x2f ? piece.slice(0, -1) : piece;
@@ -1199,18 +1229,30 @@ module.exports = class Request extends LazyReadable {
      * path, and req.query reflects the new query string. The assigned url is relative to the
      * mount the request is currently in, as it is in express, so the absolute path is rebuilt
      * from the piece the mounts had consumed.
+     *
+     * @param {boolean} [leavingMount] the caller is popping the mount the rewrite happened in
      */
-    _absorbUrlRewrite() {
-        const newUrl = String(this.url);
-        const queryIndex = newUrl.indexOf("?");
-        const newPath = queryIndex === -1 ? newUrl : newUrl.slice(0, queryIndex);
+    _absorbUrlRewrite(leavingMount) {
+        const assignedUrl = String(this.url);
+        let newUrl = assignedUrl;
         // the prefix the mounts consumed: everything of the absolute path the relative one was not
         const lastQueryIndex = this._lastUrl.indexOf("?");
         const oldPath = lastQueryIndex === -1 ? this._lastUrl : this._lastUrl.slice(0, lastQueryIndex);
-        const prefix =
-            oldPath === "/" && !this._originalPath.endsWith("/")
-                ? this._originalPath
-                : this._originalPath.slice(0, this._originalPath.length - oldPath.length);
+        let prefix;
+        if (oldPath === "/" && !this._originalPath.endsWith("/")) {
+            prefix = this._originalPath;
+            // express's slashAdded restore, applied where express applies it, on the way out of a
+            // mount that consumed the whole path: the "/" the middleware saw was invented, and the
+            // rejoin strips the first character of whatever was assigned ("/found" + "target" is
+            // "/foundtarget"). Inside the mount the assigned url routes as it is, as express does
+            if (leavingMount === true) {
+                newUrl = newUrl.slice(1);
+            }
+        } else {
+            prefix = this._originalPath.slice(0, this._originalPath.length - oldPath.length);
+        }
+        const queryIndex = newUrl.indexOf("?");
+        const newPath = queryIndex === -1 ? newUrl : newUrl.slice(0, queryIndex);
         this._rawQuery = queryIndex === -1 ? "" : newUrl.slice(queryIndex + 1);
         // a rewrite to "/a?" keeps its "?", as one arriving that way does
         this.urlQuery = queryIndex === -1 ? "" : "?" + this._rawQuery;
@@ -1220,7 +1262,9 @@ module.exports = class Request extends LazyReadable {
         this._opPath = newPath;
         this._opPathLower = null;
         this._mayFailDecode = null;
-        this._lastUrl = newUrl;
+        // the assigned string, not the mangled one: the compare against req.url must go quiet or
+        // the next hop absorbs the same rewrite again with a different prefix
+        this._lastUrl = assignedUrl;
     }
 
     /**
@@ -1251,15 +1295,16 @@ module.exports = class Request extends LazyReadable {
      * the parse cached and handed out as itself, the sanitised value leaked into req.query here and
      * a handler written against express read a trimmed value where express gives it the raw one.
      *
-     * And that is why there is no cache: the fresh object comes from parsing the raw string again,
-     * not from copying a kept parse. As first shipped this was parse-once-copy-per-read, and the
-     * copy was the expensive half: Object.assign between null-prototype objects, which live in
-     * V8's dictionary mode, measured 638ns for a two-parameter query where parsing the same string
-     * measures 119ns, and on a benchmark whose every request carries such a query it cost +1.5us
-     * of CPU per request, which a public arena saw as -8% on its query-carrying rows. A handler
-     * that reads req.query once per request now pays exactly what it paid when the parse was
-     * cached, one parse, and a handler that reads it N times pays N parses, which is express's
-     * own cost shape.
+     * And that is why there is no cache of the object: the fresh object comes from the raw
+     * string, not from copying a kept parse. As first shipped this was parse-once-copy-per-read,
+     * and the copy was the expensive half: Object.assign between null-prototype objects, which
+     * live in V8's dictionary mode, measured 638ns for a two-parameter query where parsing the
+     * same string measures 119ns, and on a benchmark whose every request carries such a query it
+     * cost +1.5us of CPU per request, which a public arena saw as -8% on its query-carrying rows.
+     *
+     * The default parser does keep the decoded pairs of its first parse, and a later read of the
+     * same raw string replays the stores into a fresh null-prototype object: identical output,
+     * still nothing shared between reads. A repeated key cannot be replayed and re-parses.
      *
      * @returns {Record<string, any>}
      */
@@ -1277,7 +1322,25 @@ module.exports = class Request extends LazyReadable {
             return Object.create(null);
         }
         if (qp === parseQuery) {
-            return parseQuery(this._rawQuery);
+            const raw = this._rawQuery;
+            if (this._querySnapRaw === raw) {
+                const snap = this._querySnap;
+                if (snap === false) {
+                    return parseQuery(raw);
+                }
+                const out = Object.create(null);
+                const pairs = /** @type {string[]} */ (snap);
+                for (let i = 0, len = pairs.length; i < len; i += 2) {
+                    out[pairs[i]] = pairs[i + 1];
+                }
+                return out;
+            }
+            /** @type {string[] & {invalid?: boolean}} */
+            const capture = [];
+            const out = parseQuery(raw, capture);
+            this._querySnapRaw = raw;
+            this._querySnap = capture.invalid === true ? false : capture;
+            return out;
         }
         if (qp === fastQueryParse) {
             return Object.assign(Object.create(null), fastQueryParse(this._rawQuery));
@@ -1686,7 +1749,9 @@ module.exports = class Request extends LazyReadable {
             const value = entries[index + 1];
             // lowercase by the entries' contract, see the field declaration
             const key = entries[index];
-            if (Object.hasOwn(headers, key)) {
+            // own values are never undefined, so the read answers "absent" without the hasOwn
+            // call; a prototype-named header reads truthy and still takes the hasOwn check
+            if (headers[key] !== undefined && Object.hasOwn(headers, key)) {
                 if (discardedDuplicates.has(key)) {
                     continue;
                 }

package/src/response.js

@@ -72,15 +72,37 @@ const symbols = Object.getOwnPropertySymbols(outgoingMessage);
 // if a future node renames it, fall back to a private symbol rather than writing a property
 // literally named "undefined", which is what indexing with undefined would do
 const kOutHeaders = symbols.find((s) => s.toString() === "Symbol(kOutHeaders)") ?? Symbol("kOutHeaders");
+// node's emitters tombstone a removed listener's slot instead of deleting it when this flag is
+// set, which is what keeps _events in a stable shape. EventEmitter.init sets it, and never runs
+// for the lazily-materialized response, so it is set by hand; a future rename degrades to the
+// delete, not to an error
+const kShapeMode =
+    Object.getOwnPropertySymbols(new EventEmitter()).find((s) => s.toString() === "Symbol(shapeMode)") ??
+    Symbol("shapeMode");
+// names setHeader has validated and lowercased, so the constant names middleware writes per
+// request are one Map hit. Insert-only after validation, bounded; only setHeader may insert,
+// the never-throwing readers keep their plain toLowerCase
+const VALIDATED_HEADER_NAMES = new Map();
 const HIGH_WATERMARK = 128 * 1024;
-// Statuses whose message carries no body, so no Content-Length may describe one either. 1xx is
-// the third case and is checked by range rather than listed.
-const STATUSES_WITHOUT_BODY = new Set([204, 304]);
+// the exact string json() writes, so send() can skip recomputing the charset on it
+const JSON_UTF8 = "application/json; charset=utf-8";
 // send's ceiling for maxAge, one year in milliseconds. Anything larger is clamped to it rather
 // than written out, since a year is already longer than any cache will honour.
 const MAX_MAXAGE = 60 * 60 * 24 * 365 * 1000;
 
 class Socket extends EventEmitter {
+    /**
+     * The Socket's own error listener, shared across sockets: an error on the stand-in closes it,
+     * which is the close the connection trackers wait for. EventEmitter calls it with this = the
+     * emitter.
+     *
+     * @this {any}
+     * @param {any} err
+     */
+    static _onError(err) {
+        this.emit("close");
+    }
+
     /**
      * Enough of a node socket for the middleware that reaches for one. There is no socket object
      * in uWS to hand over, so this stands in and forwards what it can to the response.
@@ -90,10 +112,10 @@ class Socket extends EventEmitter {
     constructor(response) {
         super();
         this.response = response;
+        this[kShapeMode] = true;
 
-        this.on("error", (err) => {
-            this.emit("close");
-        });
+        // shared, not an arrow: one per process instead of one per materialized socket
+        this.on("error", Socket._onError);
     }
 
     /** Whether anything more can be written, which stops being true once the response is done. */
@@ -276,6 +298,11 @@ module.exports = class Response extends LazyWritable {
             drain: undefined
         };
         this._eventsCount = 0;
+        // tombstone removed listeners instead of deleting the key, as node's own streams do: the
+        // delete flipped this literal to dictionary mode on every on-finished cancel
+        this[kShapeMode] = true;
+        // on-finished stores its state here; declared so that store is not a shape change
+        this.__onFinished = null;
         this._req = req;
         // linked here rather than by the caller: the pair is built together, and a field the
         // constructor leaves unset is a shape change on whoever assigns it first
@@ -801,7 +828,9 @@ module.exports = class Response extends LazyWritable {
         // without one writes "Content-Length: 9223372036854775808" onto a 204. Those two paths keep
         // µWS's own rule, which closes for a bare "close" and not for a list.
         const closeConnection = this.req._connectionClose === true;
-        if (STATUSES_WITHOUT_BODY.has(this.statusCode) || this.statusCode < 200) {
+        // 204 and 304 carry no body, so no Content-Length may describe one either; 1xx is the
+        // third case, by range
+        if (this.statusCode === 204 || this.statusCode === 304 || this.statusCode < 200) {
             // no body and no length describing one, whatever the caller passed. node decides
             // this the same way, from the status alone, so res.status(304).end("x") sends the
             // status and nothing else on either.
@@ -905,9 +934,10 @@ module.exports = class Response extends LazyWritable {
                 if (!skipContentType) {
                     this.headers["content-type"] = "text/html; charset=utf-8";
                 }
-            } else if (typeof contentType === "string") {
+            } else if (typeof contentType === "string" && contentType !== JSON_UTF8) {
                 // replaced, not only added: the body goes out as utf-8, so a content-type saying
-                // iso-8859-1 would be describing bytes that are not there.
+                // iso-8859-1 would be describing bytes that are not there. The json() literal is
+                // already exactly that, so the common res.json answer skips the recomputation
                 this.headers["content-type"] = withUtf8Charset(contentType);
             }
         } else {
@@ -1374,7 +1404,16 @@ module.exports = class Response extends LazyWritable {
         if (this.headersSent) {
             throw new Error("Cannot set headers after they are sent to the client");
         }
-        validateHeaderName(field);
+        // one Map hit for a name already validated and lowercased: middleware writes the same
+        // constant names on every request. Insert-only after validation, so no bad name can enter
+        let key = VALIDATED_HEADER_NAMES.get(field);
+        if (key === undefined) {
+            validateHeaderName(field);
+            key = field.toLowerCase();
+            if (VALIDATED_HEADER_NAMES.size < 512) {
+                VALIDATED_HEADER_NAMES.set(field, key);
+            }
+        }
         if (value === undefined) {
             /** @type {NodeJS.ErrnoException} */
             const err = new TypeError(`Invalid value "undefined" for header "${field}"`);
@@ -1388,7 +1427,7 @@ module.exports = class Response extends LazyWritable {
         // catch it
         const out = Array.isArray(value) ? value.map(String) : String(value);
         validateHeaderValue(field, out);
-        this.headers[field.toLowerCase()] = out;
+        this.headers[key] = out;
         return this;
     }
 
@@ -1737,7 +1776,11 @@ module.exports = class Response extends LazyWritable {
      * @param {string} field
      */
     removeHeader(field) {
-        delete this.headers[field.toLowerCase()];
+        const key = field.toLowerCase();
+        // the delete is a runtime call, and helmet removes a header most responses never carry
+        if (key in this.headers) {
+            delete this.headers[key];
+        }
     }
 
     /**
@@ -1912,7 +1955,7 @@ module.exports = class Response extends LazyWritable {
      */
     json(body) {
         if (!this.headers["content-type"]) {
-            this.headers["content-type"] = "application/json; charset=utf-8";
+            this.headers["content-type"] = JSON_UTF8;
         }
         const hot = this.app._hot();
         return this.send(stringify(body, hot.jsonReplacer, hot.jsonSpaces, hot.jsonEscape));

package/src/router.js

@@ -242,36 +242,45 @@ class Walk {
             // frozen here, once per scan: _pathMatches reads the two flags as bare fields, and
             // calling this per route measured 0.45us of a scan of four hundred
             router._freezeRoutingFlags();
-            // written out rather than through a predicate handed to findIndexStartingFrom, which
-            // was one closure per hop of every request not on a compiled chain
-            for (; routeIndex < routes.length; routeIndex++) {
-                const r = routes[routeIndex];
-                // A HEAD request enters a route whose path matched even when its verb cannot serve
-                // one: express exempts HEAD from the method check ("if (!hasMethod && method !==
-                // 'HEAD')" in router/index.js), so the layer's parameters are captured and its
-                // param() callbacks run before the route is dropped. Only asked when the router has
-                // callbacks to run, since entering a route to step straight back out of it is
-                // otherwise pure cost with nothing to show for it. runRoute steps over it.
-                if (!(
-                    r.all ||
-                    r.method === req.method ||
-                    req._isOptions ||
-                    (req._isHead && (r.gettable || r.paramCallbacks.size > 0))
-                )) {
-                    // taken only to fail: _preprocessRequest decodes again and turns it into the
-                    // error, so the handlers of a route this request cannot run never see it
-                    if (mayFailDecode && router._pathMatches(r, req) && router._paramsFailToDecode(r, req)) {
-                        break;
-                    }
-                    continue;
-                }
-                if (router._pathMatches(r, req)) {
-                    // matched, and then stepped over: a body parser this request gets nothing out
-                    // of costs a hop and answers with next() at the end of it
-                    if (r.bodyParserOnly === true && stepsOver(r, req)) {
+            if (routes === router._routes) {
+                // the router's own table has an index over its literal routes, so the scan visits
+                // the handful that could match instead of every one, see _scanFrom
+                routeIndex = router._scanFrom(req, routeIndex, mayFailDecode);
+            } else {
+                // a compiled chain's own array, always short: the linear scan stays.
+                // Written out rather than through a predicate handed to findIndexStartingFrom,
+                // which was one closure per hop of every request not on a compiled chain
+                const method = req.method;
+                const length = routes.length;
+                for (; routeIndex < length; routeIndex++) {
+                    const r = routes[routeIndex];
+                    // A HEAD request enters a route whose path matched even when its verb cannot
+                    // serve one: express exempts HEAD from the method check ("if (!hasMethod &&
+                    // method !== 'HEAD')" in router/index.js), so the layer's parameters are
+                    // captured and its param() callbacks run before the route is dropped. Only
+                    // asked when the router has callbacks to run, since entering a route to step
+                    // straight back out of it is otherwise pure cost. runRoute steps over it.
+                    if (!(
+                        r.all ||
+                        r.method === method ||
+                        req._isOptions ||
+                        (req._isHead && (r.gettable || r.paramCallbacks.size > 0))
+                    )) {
+                        // taken only to fail: _preprocessRequest decodes again and turns it into
+                        // the error, so the handlers of a route this request cannot run never see it
+                        if (mayFailDecode && router._pathMatches(r, req) && router._paramsFailToDecode(r, req)) {
+                            break;
+                        }
                         continue;
                     }
-                    break;
+                    if (router._pathMatches(r, req)) {
+                        // matched, and then stepped over: a body parser this request gets nothing
+                        // out of costs a hop and answers with next() at the end of it
+                        if (r.bodyParserOnly === true && stepsOver(r, req)) {
+                            continue;
+                        }
+                        break;
+                    }
                 }
             }
         }
@@ -402,7 +411,11 @@ class Walk {
                 useApp(req, route.mountApp);
             }
             const taken = mountPrefixLength(route, req);
-            (req._stack ??= []).push(taken);
+            // pushed negative when this mount consumes the whole remaining path: express invents
+            // the "/" the routes below see, and the pop has to know, see leaveHop and issue #17
+            (req._stack ??= []).push(
+                taken !== 0 && req._consumed + taken === req._originalPath.length ? -taken : taken
+            );
             // a use with no path consumes nothing, so everything below would work out the values
             // that are already there. Only skipped without a trailing slash, where the rules about
             // one cannot bite. An application is mostly pathless middleware, and this is per hop
@@ -466,6 +479,68 @@ class Walk {
         return this.step(undefined);
     }
 
+    /**
+     * Leaves the route the walk is on: the mount pop, the router hand-back, and the hop to the
+     * route after. Out of step so the commonest hop, callbacks exhausted by a plain next(), goes
+     * here without re-running step's prologue and compares.
+     *
+     * @param {boolean} isRouter next("router") rather than next("route")
+     */
+    leaveHop(isRouter) {
+        const req = this.req;
+        const route = this.route;
+        if (route.use && !route.keepMount) {
+            const pushed = req._stack.pop();
+            const taken = pushed < 0 ? -pushed : pushed;
+            // a rewrite done inside this middleware is taken now: the pop below recomputes
+            // req.url from the original path and would silently revert it. The slashAdded
+            // mangle belongs to the mount that consumed a prefix, not to a pathless use
+            if (req.url !== req._lastUrl) {
+                req._absorbUrlRewrite(taken !== 0);
+                req._consumed -= taken;
+                setMountedPath(req);
+            } else {
+                if (pushed < 0 && req._originalPath.length > req._consumed) {
+                    // a rewrite below this mount left a remainder where entry had none: express
+                    // strips the first character of it when it rejoins, see issue #17
+                    req._originalPath =
+                        req._originalPath.slice(0, req._consumed) + req._originalPath.slice(req._consumed + 1);
+                    req._mayFailDecode = null;
+                }
+                if (taken !== 0) {
+                    // a pathless use consumed nothing and rewrote nothing, so the recompute would
+                    // write back the very values it reads
+                    req._consumed -= taken;
+                    setMountedPath(req);
+                }
+            }
+            restoreApp(route, req);
+        }
+        if (isRouter) {
+            if (this.skipCheck) {
+                // on a compiled chain, leaving the router is what running out of chain
+                // already means: ordinary routing takes over after the mount. With no
+                // mount in the chain the router being left is the app's own, and nothing
+                // of it may run afterwards, not even a middleware registered later
+                if (this.skipUntil?.keepMount) {
+                    return this.dispatch(this.routes.length);
+                }
+                return this.resolve(false);
+            }
+            // out of this router entirely, so whoever mounted it carries on after the
+            // mount. The app's own walk has nobody after it, and answers 404
+            return this.resolve(false);
+        }
+        req.routeCount++;
+        // dispatch is a plain call, so a synchronous throw would escape here instead of
+        // rejecting, as it used to when this recursed through the async _routeRequest
+        try {
+            return this.dispatch(this.routeIndex + 1);
+        } catch (err) {
+            return this.reject(err);
+        }
+    }
+
     /**
      * One hop, which is what next() does: with nothing, run the route's next callback; with "route",
      * leave the route; with anything else, remember it as the error and carry on.
@@ -479,39 +554,7 @@ class Walk {
         const router = this.router;
         if (thingamabob) {
             if (thingamabob === "route" || thingamabob === "router") {
-                if (route.use && !route.keepMount) {
-                    // a rewrite done inside this middleware is taken now: the pop below recomputes
-                    // req.url from the original path and would silently revert it
-                    if (req.url !== req._lastUrl) {
-                        req._absorbUrlRewrite();
-                    }
-                    req._consumed -= req._stack.pop();
-                    setMountedPath(req);
-                    restoreApp(route, req);
-                }
-                if (thingamabob === "router") {
-                    if (this.skipCheck) {
-                        // on a compiled chain, leaving the router is what running out of chain
-                        // already means: ordinary routing takes over after the mount. With no
-                        // mount in the chain the router being left is the app's own, and nothing
-                        // of it may run afterwards, not even a middleware registered later
-                        if (this.skipUntil?.keepMount) {
-                            return this.dispatch(this.routes.length);
-                        }
-                        return this.resolve(false);
-                    }
-                    // out of this router entirely, so whoever mounted it carries on after the
-                    // mount. The app's own walk has nobody after it, and answers 404
-                    return this.resolve(false);
-                }
-                req.routeCount++;
-                // dispatch is a plain call, so a synchronous throw would escape here instead of
-                // rejecting, as it used to when this recursed through the async _routeRequest
-                try {
-                    return this.dispatch(this.routeIndex + 1);
-                } catch (err) {
-                    return this.reject(err);
-                }
+                return this.leaveHop(thingamabob === "router");
             } else {
                 req._error = thingamabob;
                 req._errorKey = route.routeKey;
@@ -521,7 +564,7 @@ class Walk {
         const kind = route.callbackKinds[this.callbackIndex];
         const callback = route.callbacks[this.callbackIndex++];
         if (!callback) {
-            return this.step("route");
+            return this.leaveHop(false);
         }
         // skipping routes we already went through via optimized path. Before the Router branch
         // below and not after it: a mount whose chain was compiled has already run, and running it
@@ -715,6 +758,10 @@ function mountPrefixLength(route, req) {
     if (route.pattern === EMPTY_REGEX) {
         return 0;
     }
+    // the registration-time constant of a literal mount, exec-free. See createRoute
+    if (route.mountLen !== undefined) {
+        return route.mountLen;
+    }
     if (typeof route.pattern === "string") {
         return route.pattern.length;
     }
@@ -801,6 +848,61 @@ function mergesParams(route, fallback) {
     return Boolean(owner?._settings?.mergeParams);
 }
 
+// shared empty candidate list, so _scanFrom never tests for a missing map entry twice
+const EMPTY_INDICES = /** @type {number[]} */ ([]);
+
+/**
+ * The generic scan's index over a router's literal routes: route positions by folded pattern, so
+ * a scan visits the routes registered for this exact path instead of comparing every one. String
+ * patterns are pure literals, everything else, "/*" included, stays in alwaysVisit and is still
+ * matched per request by _pathMatches.
+ *
+ * @param {any[]} routes the router's own table
+ * @param {boolean} caseFlag the frozen case-sensitivity flag
+ * @returns {{map: Map<string, number[]>, alwaysVisit: number[]}}
+ */
+function buildLiteralIndex(routes, caseFlag) {
+    const map = new Map();
+    const alwaysVisit = [];
+    for (let i = 0; i < routes.length; i++) {
+        const pattern = routes[i].pattern;
+        if (typeof pattern === "string" && pattern !== "/*") {
+            const key = caseFlag ? pattern : routes[i].patternLower;
+            const list = map.get(key);
+            if (list === undefined) {
+                map.set(key, [i]);
+            } else {
+                list.push(i);
+            }
+        } else {
+            alwaysVisit.push(i);
+        }
+    }
+    return { map, alwaysVisit };
+}
+
+/**
+ * The position of the first value >= from in an ascending list, which is list.length when there
+ * is none: where a scan resuming at `from` enters a candidate list.
+ *
+ * @param {number[]} list
+ * @param {number} from
+ * @returns {number}
+ */
+function firstAtLeast(list, from) {
+    let low = 0;
+    let high = list.length;
+    while (low < high) {
+        const mid = (low + high) >> 1;
+        if (list[mid] < from) {
+            low = mid + 1;
+        } else {
+            high = mid;
+        }
+    }
+    return low;
+}
+
 /**
  * The route's own params merged with those of the mounts it sits under, in express's order: an
  * outer mount first, the route's own last. Numbered captures do not overwrite each other, they
@@ -1712,6 +1814,90 @@ module.exports = class Router extends EventEmitter {
         return fullMountpath;
     }
 
+    /**
+     * The generic scan over this router's own table, driven by the literal index: only the routes
+     * registered for this exact path, plus every non-literal route, are visited, in registration
+     * order, and each visited one still answers through the same method gate and _pathMatches the
+     * plain loop used. The routes skipped are exactly the literals whose string compare provably
+     * fails, so the first index this answers is the one the plain loop found.
+     *
+     * Runs after _freezeRoutingFlags, which is what makes _caseFlag and _strictFlag readable here
+     * and the lazily built index stable.
+     *
+     * @param {any} req
+     * @param {number} startIndex where to resume the scan
+     * @param {boolean} mayFailDecode whether the path carries a percent escape
+     * @returns {number} the index of the route to enter, or the table length for none
+     */
+    _scanFrom(req, startIndex, mayFailDecode) {
+        const routes = this._routes;
+        const index = (this._literalIndex ??= buildLiteralIndex(routes, /** @type {boolean} */ (this._caseFlag)));
+        let path = req._opPath;
+        if (path === "") {
+            path = "/";
+        }
+        if (!this._caseFlag) {
+            path = req._opPathLower ??= path.toLowerCase();
+        }
+        const exact = index.map.get(path) ?? EMPTY_INDICES;
+        // the trailing-slash twin _pathMatches allows outside strict routing, as a key: a path
+        // "/a/" can only text-match a literal "/a", so that list joins the candidates
+        const slashed =
+            !this._strictFlag && path.charCodeAt(path.length - 1) === 0x2f
+                ? (index.map.get(path.slice(0, -1)) ?? EMPTY_INDICES)
+                : EMPTY_INDICES;
+        const always = index.alwaysVisit;
+        let exactAt = firstAtLeast(exact, startIndex);
+        let slashedAt = firstAtLeast(slashed, startIndex);
+        let alwaysAt = firstAtLeast(always, startIndex);
+        const method = req.method;
+        const none = routes.length;
+        for (;;) {
+            // the next candidate in registration order, from whichever list holds it
+            let routeIndex = none;
+            if (exactAt < exact.length && exact[exactAt] < routeIndex) {
+                routeIndex = exact[exactAt];
+            }
+            if (slashedAt < slashed.length && slashed[slashedAt] < routeIndex) {
+                routeIndex = slashed[slashedAt];
+            }
+            if (alwaysAt < always.length && always[alwaysAt] < routeIndex) {
+                routeIndex = always[alwaysAt];
+            }
+            if (routeIndex === none) {
+                return none;
+            }
+            if (exactAt < exact.length && exact[exactAt] === routeIndex) {
+                exactAt++;
+            }
+            if (slashedAt < slashed.length && slashed[slashedAt] === routeIndex) {
+                slashedAt++;
+            }
+            if (alwaysAt < always.length && always[alwaysAt] === routeIndex) {
+                alwaysAt++;
+            }
+            const r = routes[routeIndex];
+            // the same gates as the plain loop, comments and all: see dispatch
+            if (!(
+                r.all ||
+                r.method === method ||
+                req._isOptions ||
+                (req._isHead && (r.gettable || r.paramCallbacks.size > 0))
+            )) {
+                if (mayFailDecode && this._pathMatches(r, req) && this._paramsFailToDecode(r, req)) {
+                    return routeIndex;
+                }
+                continue;
+            }
+            if (this._pathMatches(r, req)) {
+                if (r.bodyParserOnly === true && stepsOver(r, req)) {
+                    continue;
+                }
+                return routeIndex;
+            }
+        }
+    }
+
     /**
      * Whether a route's path matches this request. A plain string compares directly, which is what
      * makes a route eligible for the native router; anything carrying a parameter or a wildcard was
@@ -1887,6 +2073,13 @@ module.exports = class Router extends EventEmitter {
                 // the "body methods" setting as it stood the first time this layer was reached,
                 // kept the way the parser behind it keeps it. undefined until then
                 bodyMethods: undefined,
+                // a literal mount consumes exactly its registered text, so what the per-hop exec
+                // in mountPrefixLength answers is a constant. "/" stays with the exec: its clamp
+                // against a parent that consumed everything is not a constant
+                mountLen:
+                    method === "USE" && typeof path === "string" && path.length > 1 && !/[:*{\\]/.test(path)
+                        ? path.length
+                        : undefined,
                 // a mount written as a RegExp matches a piece of path that is not known until a
                 // request comes in, so its stack entry cannot be the path itself
                 regexMount: method === "USE" && path instanceof RegExp,
@@ -1937,6 +2130,8 @@ module.exports = class Router extends EventEmitter {
             routes.push(route);
         }
         this._routes.push(...routes);
+        // the literal index positions are stale the moment the table grows
+        this._literalIndex = undefined;
 
         // anything registered after listen invalidates what the header-skip analysis proved:
         // it could catch a throw or read what a chain never did, so every skip is taken back
@@ -2396,14 +2591,23 @@ module.exports = class Router extends EventEmitter {
                   needsConversionToRegex(p) ? patternToRegex(p, false, false) : p.toLowerCase()
               )
             : null;
-        const makeHandler = (chain, preset, skips) => {
+        const makeHandler = (chain, preset, skips, wireMethod) => {
             // the mutable object a granted skip lives on, so a middleware arriving after
             // listen can take it back: a literal registration's preset doubles as it, and a
-            // parameterised one, which has no preset, gets a holder of its own
+            // parameterised one, which has no preset, gets a holder of its own. It also carries
+            // the registration's method, so the constructor settles it with one compare
             let skipHolder = preset;
-            if (skipHolder === undefined && (skips.skipHeaders || skips.skipQuery)) {
-                skipHolder = { skipHeaders: skips.skipHeaders, skipQuery: skips.skipQuery };
-                (this._skipPresets ??= new Set()).add(skipHolder);
+            if (skipHolder === undefined && (skips.skipHeaders || skips.skipQuery || wireMethod !== null)) {
+                skipHolder = {
+                    skipHeaders: skips.skipHeaders,
+                    skipQuery: skips.skipQuery,
+                    method: wireMethod,
+                    isOptions: wireMethod === "OPTIONS",
+                    isHead: wireMethod === "HEAD"
+                };
+                if (skips.skipHeaders || skips.skipQuery) {
+                    (this._skipPresets ??= new Set()).add(skipHolder);
+                }
             }
             // all three are registration-time constants: computing them in the handler was a
             // closure and a scan of the chain on every native request.
@@ -2430,6 +2634,8 @@ module.exports = class Router extends EventEmitter {
                     return this._refuseRequest(response);
                 }
                 if (optimizedParams) {
+                    // slicing these out of the already-fetched path instead measured a wash:
+                    // the segment scan costs what the crossing costs
                     request.optimizedParams = new NullObject();
                     for (let i = 0; i < optimizedParams.length; i++) {
                         request.optimizedParams[optimizedParams[i]] = req.getParameter(i);
@@ -2475,8 +2681,8 @@ module.exports = class Router extends EventEmitter {
         // analysis in usage.js, whose default answer is no.
         //
         // The etag setting is not one of the conditions. It used to be, on the grounds that send
-        // consults freshness, but the skip branch reads if-none-match, if-modified-since and
-        // cache-control by name whatever the setting, see the comment at request.js:527, and
+        // consults freshness, but the skip branch reads if-none-match and if-modified-since by
+        // name whatever the setting, see the comment at request.js:527, and
         // req.fresh reads nothing else off the request. Requiring etag off as well cost the copy
         // to every application that left it on, which is every application that did not go
         // looking for the setting.
@@ -2508,10 +2714,13 @@ module.exports = class Router extends EventEmitter {
             return preset;
         };
 
+        // the wire token this registration answers; "any" serves every verb and stays dynamic
+        const wireMethod = method === "any" ? null : route.method;
         let fn = makeHandler(
             getChain,
             canPreset ? makePreset(route.path, route.method, getSkips) : undefined,
-            getSkips
+            getSkips,
+            wireMethod
         );
         const jsFn = fn;
 
@@ -2564,7 +2773,12 @@ module.exports = class Router extends EventEmitter {
                 fn !== jsFn
                     ? fn
                     : canPreset
-                      ? makeHandler(getChain, makePreset(route.path + "/", route.method, getSkips), getSkips)
+                      ? makeHandler(
+                            getChain,
+                            makePreset(route.path + "/", route.method, getSkips),
+                            getSkips,
+                            wireMethod
+                        )
                       : fn;
             this.uwsApp[method](replacedPath + "/", slashFn);
             if (method === "get") {
@@ -2573,7 +2787,8 @@ module.exports = class Router extends EventEmitter {
                     makeHandler(
                         headChain,
                         canPreset ? makePreset(route.path + "/", "HEAD", headSkips) : undefined,
-                        headSkips
+                        headSkips,
+                        "HEAD"
                     )
                 );
             }
@@ -2582,7 +2797,12 @@ module.exports = class Router extends EventEmitter {
             // its own handler always: the shared one would carry the GET registration's method
             this.uwsApp.head(
                 replacedPath,
-                makeHandler(headChain, canPreset ? makePreset(route.path, "HEAD", headSkips) : undefined, headSkips)
+                makeHandler(
+                    headChain,
+                    canPreset ? makePreset(route.path, "HEAD", headSkips) : undefined,
+                    headSkips,
+                    "HEAD"
+                )
             );
         }
     }
@@ -2741,14 +2961,16 @@ module.exports = class Router extends EventEmitter {
                 raiseDecodeFailure(req, route, err);
                 return "route";
             }
-            if (mergesParams(route, this) && req._paramStack !== null && req._paramStack.length > 0) {
+            // the stack check first: it is two field loads, mergesParams is a call, and almost
+            // no request carries a param stack at all
+            if (req._paramStack !== null && req._paramStack.length > 0 && mergesParams(route, this)) {
                 req.params = mergeParams(req.params, req._paramStack);
             }
         } else {
             // express 5 gives every matched route null-prototype params; only a pathless
             // middleware layer keeps the plain object, as its router hands one to fast_slash
             req.params = route.use && route.path === "" ? {} : Object.create(null);
-            if (mergesParams(route, this) && req._paramStack !== null && req._paramStack.length > 0) {
+            if (req._paramStack !== null && req._paramStack.length > 0 && mergesParams(route, this)) {
                 req.params = mergeParams(req.params, req._paramStack);
             }
         }
@@ -3132,8 +3354,12 @@ module.exports = class Router extends EventEmitter {
             return;
         }
         response.status(404);
-        // the whole path, not what a mount left behind in req.path
-        this._sendErrorPage(request, response, `Cannot ${request.method} ${request._originalPath}`, false);
+        // the pathname of originalUrl, as express's finalhandler prints it: _originalPath absorbs
+        // a req.url rewrite, originalUrl never changes
+        const originalUrl = String(request.originalUrl);
+        const queryIndex = originalUrl.indexOf("?");
+        const pathname = queryIndex === -1 ? originalUrl : originalUrl.slice(0, queryIndex);
+        this._sendErrorPage(request, response, `Cannot ${request.method} ${pathname}`, false);
     }
 };
 

package/src/utils.js

@@ -1510,6 +1510,11 @@ function validateHeaderName(name) {
     }
 }
 
+// values already accepted, so the constant strings middleware writes per request, helmet's CSP
+// among them, skip the scan. Insert-only after the regex accepts, so a hit cannot change a
+// verdict; bounded, and set-cookie values are per-user so they stay out
+const KNOWN_HEADER_VALUES = new Set();
+
 /**
  * Refuses a header value holding a character that cannot go on the wire, with node's error. An
  * array is sent as one header per entry, so each entry is checked on its own rather than as the
@@ -1527,9 +1532,19 @@ function validateHeaderValue(name, value) {
         }
         return;
     }
+    if (KNOWN_HEADER_VALUES.has(value)) {
+        return;
+    }
     if (HEADER_VALUE.test(value)) {
         throw headerError(`Invalid character in header content ["${name}"]`, "ERR_INVALID_CHAR");
     }
+    if (
+        KNOWN_HEADER_VALUES.size < 512 &&
+        value.length <= 1024 &&
+        !(name.length === 10 && name.toLowerCase() === "set-cookie")
+    ) {
+        KNOWN_HEADER_VALUES.add(value);
+    }
 }
 
 /**