fulmine.js 5.21.2 → 5.21.3

package/README.md

@@ -1,6 +1,6 @@
 <img src="./assets/logo-mark.svg" alt="" width="88" align="right">
 
-# Fulmine.js: the drop-in Express 5 replacement, up to 20x faster
+# Fulmine.js: the drop-in Express 5 replacement, up to 22x faster
 
 **Fulmine** (lightning in Italian ⚡) is an Express 5 compatible web framework for Node.js, built on
 [µWebSockets.js](https://github.com/uNetworking/uWebSockets.js) instead of `node:http`. Same API, same
@@ -24,8 +24,8 @@ const express = require("fulmine.js"); // instead of require("express")
 
 ## Why Fulmine
 
-- **Faster than Express, measured.** 1.3x to 4.9x on plain routing, 2x to 5x on a request with a body,
-  7x to 20x on a large route table. Routes are matched in C++ by µWS's own router,
+- **Faster than Express, measured.** 1.2x to 4.5x on plain routing, 1.7x to 5x on a request with a body,
+  7x to 22x on a large route table. Routes are matched in C++ by µWS's own router,
   and a simple enough handler is answered without running any JavaScript at all.
 - **Zero rewrite.** `helmet`, `cors`, `passport`, `morgan`, `multer`, `express-session` and the rest of
   the Express ecosystem keep working. Not "mostly": every test runs against real Express first and the

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.21.2",
+    "version": "5.21.3",
     "description": "Drop-in Express 5 replacement on uWebSockets.js, up to 20x faster. Same API, your middleware and framework keep working.",
     "main": "src/index.js",
     "exports": {

package/src/declarative.js

@@ -236,6 +236,11 @@ function readStatusAndHeaders(callExprs, headers) {
 
             for (let [header, value] of pairs) {
                 const name = String(header).toLowerCase();
+                // a chunked framing the handler asked for: a compiled response is one end() with a
+                // length, the ordinary path frames it through write(), see Response#writeHeaders
+                if (name === "transfer-encoding") {
+                    return null;
+                }
                 // res.set resolves a content-type through the mime database, setHeader does not
                 if (call.obj.propertyName !== "setHeader" && name === "content-type") {
                     const resolved = contentTypeSet(String(value));
@@ -266,6 +271,9 @@ function readStatusAndHeaders(callExprs, headers) {
             if (call.arguments[0].type !== "Literal" || call.arguments[1].type !== "Literal") {
                 return null;
             }
+            if (String(call.arguments[0].value).toLowerCase() === "transfer-encoding") {
+                return null;
+            }
             if (!headerIsWritable(String(call.arguments[0].value), String(call.arguments[1].value))) {
                 return null;
             }
@@ -289,8 +297,8 @@ function readStatusAndHeaders(callExprs, headers) {
  * @param {[string, string][]} headers written to
  * @param {any[]} body written to, a literal's value kept as it is
  * @param {Application|Router} app for the json settings
- * @param {string[]} queries names bound by a destructured req.query
- * @param {string[]} params names bound by a destructured req.params
+ * @param {Binding[]} queries what a destructured req.query bound
+ * @param {Binding[]} params what a destructured req.params bound
  * @returns {{sendUsed: boolean, bodyFromSend: boolean}|null}
  */
 function readBody(callExprs, headers, body, app, queries, params) {
@@ -383,10 +391,14 @@ function readBody(callExprs, headers, body, app, queries, params) {
                             }
                             body.push({ type, value: expr.property.name });
                         } else if (expr.type === "Identifier") {
-                            if (queries.includes(expr.name)) {
-                                body.push({ type: "query", value: expr.name });
-                            } else if (params.includes(expr.name)) {
-                                body.push({ type: "params", value: expr.name });
+                            // the key, not the local name: a minifier renames the local and uWS
+                            // would be asked for a parameter that does not exist
+                            const query = queries.find((binding) => binding.local === expr.name);
+                            const param = params.find((binding) => binding.local === expr.name);
+                            if (query) {
+                                body.push({ type: "query", value: query.key });
+                            } else if (param) {
+                                body.push({ type: "params", value: param.key });
                             } else {
                                 return null;
                             }
@@ -550,9 +562,40 @@ function readHandler(cb) {
  * @property {string} res
  * @property {string|undefined} queryName
  * @property {string|undefined} paramsName
- * @property {string[]} queries
- * @property {string[]} params
+ * @property {Binding[]} queries
+ * @property {Binding[]} params
+ */
+
+/**
+ * One name a destructured req.query or req.params bound, with the key it stands for: the same
+ * word in `{ id }`, two after a minifier has been through (`{ id: c }`).
+ * @typedef {object} Binding
+ * @property {string} local
+ * @property {string} key
+ */
+
+/**
+ * The bindings of one destructuring pattern, `{ id, name: n }`. False for a shape this cannot
+ * read: a computed key, a rest element, a default value or a nested pattern.
+ *
+ * @param {any} pattern an ObjectPattern node
+ * @param {Binding[]} into
+ * @returns {boolean}
  */
+function readBindings(pattern, into) {
+    for (const prop of pattern.properties) {
+        if (
+            prop.type !== "Property" ||
+            prop.computed ||
+            prop.key.type !== "Identifier" ||
+            prop.value.type !== "Identifier"
+        ) {
+            return false;
+        }
+        into.push({ local: prop.value.name, key: prop.key.name });
+    }
+    return true;
+}
 
 /**
  * The names a destructured `req` binds for query and params; null for a pattern this cannot read.
@@ -574,11 +617,8 @@ function readParamNames(fn, args) {
         if (query?.value?.type === "Identifier") {
             queryName = query.value.name;
         } else if (query?.value?.type === "ObjectPattern") {
-            for (const prop of query.value.properties) {
-                if (prop.value.type !== "Identifier") {
-                    return null;
-                }
-                queries.push(prop.value.name);
+            if (!readBindings(query.value, queries)) {
+                return null;
             }
         } else {
             return null;
@@ -587,11 +627,8 @@ function readParamNames(fn, args) {
         if (param?.value?.type === "Identifier") {
             paramsName = param.value.name;
         } else if (param?.value?.type === "ObjectPattern") {
-            for (const prop of param.value.properties) {
-                if (prop.value.type !== "Identifier") {
-                    return null;
-                }
-                params.push(prop.value.name);
+            if (!readBindings(param.value, params)) {
+                return null;
             }
         } else {
             return null;
@@ -698,8 +735,8 @@ function identifiersAllowed(fn, args, names) {
             (identifiers[i - 2] === req && identifiers[i - 1] === "query") ||
             id === queryName ||
             id === paramsName ||
-            queries.includes(id) ||
-            params.includes(id)
+            queries.some((binding) => binding.local === id) ||
+            params.some((binding) => binding.local === id)
     );
 }
 // A uWS declarative response never enters node, so it is very fast. Only a handler that is simple

package/src/middlewares.js

@@ -799,11 +799,16 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             checkOptions(options);
         }
         // bytes.parse only on a string: bytes(1024) formats it to "1KB" and no comparison held
-        if (typeof options.limit === "undefined") {
-            options.limit = /** @type {number} */ (bytes.parse("100kb"));
+        if (options.limit === undefined || options.limit === null) {
+            options.limit = 100 * 1024;
         } else if (typeof options.limit !== "number") {
-            // null for a size it cannot read, as body-parser passes it along
-            options.limit = /** @type {number} */ (bytes.parse(options.limit));
+            // a size it cannot read is refused here, as body-parser 2.3 does: passed along as
+            // null it disabled the limit (CVE-2026-12590)
+            const parsed = bytes.parse(options.limit);
+            if (parsed === null) {
+                throw new TypeError(`option limit "${String(options.limit)}" is invalid`);
+            }
+            options.limit = parsed;
         }
 
         const limit = /** @type {number} */ (options.limit);

package/src/response.js

@@ -115,6 +115,9 @@ const MAX_MAXAGE = 60 * 60 * 24 * 365 * 1000;
 // what send takes as a range request, checked on the header's text before parsing
 const BYTES_RANGE = /^ *bytes=/;
 
+// node's test for a Transfer-Encoding that means chunked framing
+const CHUNKED_VALUE = /(?:^|\W)chunked(?:$|\W)/i;
+
 module.exports = class Response extends LazyWritable {
     /** @type {Socket|null} */
     #socket = null;
@@ -142,6 +145,13 @@ module.exports = class Response extends LazyWritable {
     /** Whether the status line and the headers have reached uWS, which only a body write does. */
     #headOut = false;
 
+    /**
+     * Whether the application set Transfer-Encoding: chunked itself. The body then goes out
+     * through uWS's write(), which frames it and writes the header, and no Content-Length is
+     * added beside it, as express 5.3 and node do. See writeHeaders and _finish.
+     */
+    #userChunked = false;
+
     /**
      * The status as writeHead settled it, the one the wire gets: a status set later never reaches
      * the client, as in node.
@@ -619,6 +629,17 @@ module.exports = class Response extends LazyWritable {
                 this.totalSize = parseInt(value);
                 continue;
             }
+            if (
+                header === "transfer-encoding" &&
+                typeof value === "string" &&
+                res._nodeRes === undefined &&
+                CHUNKED_VALUE.test(value)
+            ) {
+                // not written: uWS writes its own on the write() path, two came out before. Node's
+                // own response, behind the shim, frames by the header itself
+                this.#userChunked = true;
+                continue;
+            }
             // the recurring names and values cross as cached Buffers, see HEADER_NAME_BUF
             const name = HEADER_NAME_BUF[header] || header;
             if (Array.isArray(value)) {
@@ -759,9 +780,10 @@ module.exports = class Response extends LazyWritable {
             this._res.endWithoutBody();
         } else if (!data && contentLength) {
             this._res.endWithoutBody(contentLength.toString(), closeConnection);
-        } else if (headWasAlreadyOut && this.chunkedTransfer) {
+        } else if ((headWasAlreadyOut && this.chunkedTransfer) || (this.#userChunked && this._hasBody && data)) {
             // the queue first, then the last piece as a chunk: the head already went out without a
-            // length, and uWS's end() would append one
+            // length, or the application asked for chunked framing, and uWS's end() would append one.
+            // An empty body under that header takes end() below: uWS frames nothing without a write()
             this.#flushQueued(null);
             if (data) {
                 this._res.write(data);
@@ -770,9 +792,15 @@ module.exports = class Response extends LazyWritable {
             this._res.endWithoutBody();
         } else {
             if (!this._hasBody) {
-                const length = Buffer.byteLength(data ?? "");
-                this.headers["content-length"] = String(length);
-                this._res.endWithoutBody(length, closeConnection);
+                if (this.#userChunked) {
+                    // a HEAD under the application's chunked framing carries no length, as node.
+                    // No arguments: given a close flag alone, uWS writes a 2^63 length
+                    this._res.endWithoutBody();
+                } else {
+                    const length = Buffer.byteLength(data ?? "");
+                    this.headers["content-length"] = String(length);
+                    this._res.endWithoutBody(length, closeConnection);
+                }
             } else {
                 this._sentBody = data ?? "";
                 // null is the empty body: uWS never ends a response given end(null)
@@ -892,9 +920,10 @@ module.exports = class Response extends LazyWritable {
             body = "";
         }
         // by req.method as express's send does, so a GET a middleware made a HEAD answers its
-        // length and no body; end() alone decides by the wire, see _hasBody
+        // length and no body; end() alone decides by the wire, see _hasBody. No length beside a
+        // Transfer-Encoding the application set, as express 5.3
         if (this.req.method === "HEAD") {
-            if (this.statusCode !== 204 && this.statusCode !== 304) {
+            if (this.statusCode !== 204 && this.statusCode !== 304 && !this.headers["transfer-encoding"]) {
                 this.headers["content-length"] = String(Buffer.byteLength(body));
             }
             return this.end();

package/src/usage.js

@@ -143,6 +143,20 @@ function analyze(fn) {
         if (mask & UNKNOWN) {
             return;
         }
+        // a member read off what a call returned: res.status(200).sendFile() is a sendFile on res,
+        // every chainable method returns res itself, so it is judged as one. Reading it off the
+        // call had let sendFile and redirect through, and a Range or an Accept then went unread
+        if (
+            node.type === "MemberExpression" &&
+            node.object.type === "CallExpression" &&
+            resName !== null &&
+            chainRoot(node.object) === resName
+        ) {
+            if (node.computed || !RES_OK.has(node.property.name)) {
+                mask |= UNKNOWN;
+            }
+            return;
+        }
         if (node.type === "MemberExpression" && !node.computed && node.object.type === "Identifier") {
             const owner = node.object.name;
             if (owner !== reqName) {
@@ -227,6 +241,25 @@ function analyze(fn) {
     return mask;
 }
 
+/**
+ * The identifier a chain of members and calls starts from: res for res.status(200).sendFile().
+ *
+ * @param {any} node
+ * @returns {string|null} null when the chain does not start from a plain identifier
+ */
+function chainRoot(node) {
+    while (node) {
+        if (node.type === "MemberExpression") {
+            node = node.object;
+        } else if (node.type === "CallExpression") {
+            node = node.callee;
+        } else {
+            return node.type === "Identifier" ? node.name : null;
+        }
+    }
+    return null;
+}
+
 /**
  * Walks every node by key, handing each its parent.
  *
@@ -275,12 +308,16 @@ function chainUsage(chain, allowTerminalNext) {
             return none;
         }
         const terminal = i === chain.length - 1;
-        for (const cb of callbacks) {
+        for (let j = 0; j < callbacks.length; j++) {
+            const cb = callbacks[j];
             if (typeof cb !== "function") {
                 return none;
             }
             const mask = callbackUsage(cb);
-            if (mask & UNKNOWN || (mask & NEXT_PLAIN && terminal && !allowTerminalNext)) {
+            // a bare next() leaves the chain only from the route's last callback: from one in
+            // front of it, the step lands on the next callback of the same route, judged here too
+            const last = terminal && j === callbacks.length - 1;
+            if (mask & UNKNOWN || (mask & NEXT_PLAIN && last && !allowTerminalNext)) {
                 return none;
             }
             if (mask & QUERY) {