ultimate-express 2.0.17 → 2.1.0

package/README.md

@@ -24,7 +24,7 @@ Similar projects based on uWebSockets:
 
 ## Performance
 
-### Test results
+### Performance against Express
 
 Tested using [wrk](https://github.com/wg/wrk) (`-d 60 -t 1 -c 200`). Tested on Ubuntu 22.04, Node.js 20.17.0, AMD Ryzen 5 3600, 64GB RAM.
 
@@ -40,25 +40,9 @@ Tested using [wrk](https://github.com/wg/wrk) (`-d 60 -t 1 -c 200`). Tested on U
 | middlewares/compression-file (/small-file)    | 4.81k           | 14.92k           | 386 MB/sec         | 1.17 GB/sec         | **3.10X**        |
 
 ### Performance against other frameworks
-
-Tested using [bun-http-framework-benchmark](https://github.com/dimdenGD/bun-http-framework-benchmark). This table only includes Node.js results.
-For full table with other runtimes, check [here](https://github.com/dimdenGD/bun-http-framework-benchmark?tab=readme-ov-file#results).
-
-|  Framework           | Average        | Ping          | Query         | Body          |
-| -------------------- | -------------- | ------------- | ------------- | ------------- |
-| uws                  | 95,531.277     | 109,960.35    | 105,601.47    | 71,032.01     |
-| **ultimate-express (declarative)** | **86,794.997** | **108,546.44** | **105,869.75** | **45,968.8** |
-| hyper-express        | 68,959.92      | 82,547.21     | 71,685.51     | 52,647.04     |
-| **ultimate-express** | **60,839.75** | **68,938.53** | **66,173.86** | **47,406.86** |
-| h3                   | 35,423.263     | 41,243.68     | 34,429.26     | 30,596.85     |
-| fastify              | 33,094.62      | 40,147.67     | 40,076.35     | 19,059.84     |
-| hono                 | 26,576.02      | 36,215.35     | 34,656.12     | 8,856.59      |
-| koa                  | 24,045.08      | 28,202.12     | 24,590.84     | 19,342.28     |
-| express              | 10,411.313     | 11,245.57     | 10,598.74     | 9,389.63      |
-
-Other benchmarks:
  - [TechEmpower / FrameworkBenchmarks](https://www.techempower.com/benchmarks/#section=data-r23&test=plaintext&l=zik0sf-pa7)
  - [the-benchmarker / web-frameworks](https://web-frameworks-benchmark.netlify.app/result?l=javascript)
+ - [HttpArena](https://www.http-arena.com/leaderboard/)
 
 ### Performance on real-world application
 
@@ -237,7 +221,7 @@ In general, basically all features and options are supported. Use [Express 4.x d
 - ✅ req.subdomains
 - ✅ req.xhr
 - 🚧 req.route (route implementation is different from Express)
-- 🚧 req.connection, req.socket (only `end()`, `encrypted`, `remoteAddress` and `localPort` are supported)
+- 🚧 req.connection, req.socket (only `end()`, `encrypted`, `remoteAddress`, `remotePort` and `localPort` are supported)
 - ✅ req.accepts()
 - ✅ req.acceptsCharsets()
 - ✅ req.acceptsEncodings()
@@ -333,6 +317,7 @@ Almost all middlewares that are compatible with Express are compatible with µEx
 - ✅ [swagger-ui-express](https://www.npmjs.com/package/swagger-ui-express)
 - ✅ [graphql-http](https://www.npmjs.com/package/graphql-http)
 - ✅ [better-sse](https://www.npmjs.com/package/better-sse)
+- ✅ [supertest](https://www.npmjs.com/package/supertest)
 
 Middlewares and modules that are confirmed to not work:
 

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "ultimate-express",
-  "version": "2.0.17",
+  "version": "2.1.0",
   "description": "The Ultimate Express. Fastest http server with full Express compatibility, based on uWebSockets.",
   "main": "src/index.js",
   "scripts": {
     "test": "node tests/index.js",
-    "dev": "node --inspect=9229 demo/index.js",
+    "test:types": "tsd --files tests/types/*.test-d.ts",
+    "benchmark:compare": "node benchmark/run.js",
     "cover": "npm run cover:unit && npm run cover:report",
     "cover:unit": "nyc --silent npm run test",
     "cover:report": "nyc report --reporter=html"
@@ -43,10 +44,11 @@
   },
   "homepage": "https://github.com/dimdenGD/ultimate-express#readme",
   "dependencies": {
-    "@types/express": "^4.17.21",
+    "@types/express": "^4.17.25",
     "accepts": "^1.3.8",
-    "acorn": "^8.15.0",
+    "acorn": "^8.16.0",
     "bytes": "^3.1.2",
+    "content-disposition": "^1.1.0",
     "cookie": "^1.1.1",
     "cookie-signature": "^1.2.2",
     "encodeurl": "^2.0.0",
@@ -57,22 +59,23 @@
     "mime-types": "^2.1.35",
     "ms": "^2.1.3",
     "proxy-addr": "^2.0.7",
-    "qs": "^6.14.1",
+    "qs": "^6.15.1",
     "range-parser": "^1.2.1",
     "statuses": "^2.0.2",
     "tseep": "^1.3.1",
     "type-is": "^2.0.1",
-    "uWebSockets.js": "github:uNetworking/uWebSockets.js#v20.56.0",
+    "uWebSockets.js": "github:uNetworking/uWebSockets.js#v20.64.0",
     "vary": "^1.1.2"
   },
   "devDependencies": {
     "@codechecks/client": "^0.1.12",
+    "@types/node": "^25.5.2",
     "better-sse": "^0.16.1",
-    "body-parser": "^2.2.1",
+    "body-parser": "^2.2.2",
     "compression": "^1.8.1",
     "cookie-parser": "^1.4.7",
     "cookie-session": "^2.1.1",
-    "cors": "^2.8.5",
+    "cors": "^2.8.6",
     "ejs": "^3.1.10",
     "errorhandler": "^1.5.2",
     "eventsource": "^4.1.0",
@@ -82,30 +85,32 @@
     "express-async-errors": "^3.1.1",
     "express-dot-engine": "^1.0.8",
     "express-fileupload": "^1.5.2",
-    "express-handlebars": "^8.0.4",
+    "express-handlebars": "^8.0.7",
     "express-http-proxy": "^2.1.2",
     "express-mongo-sanitize": "^2.2.0",
-    "express-rate-limit": "^8.2.1",
-    "express-session": "^1.18.2",
+    "express-rate-limit": "^8.3.2",
+    "express-session": "^1.19.0",
     "express-subdomain": "^1.0.6",
     "graphql-http": "^1.22.4",
     "helmet": "^8.1.0",
     "http-proxy-middleware": "^3.0.5",
     "method-override": "^3.0.0",
     "morgan": "^1.10.1",
-    "multer": "^2.0.2",
+    "multer": "^2.1.1",
     "mustache-express": "^1.3.2",
     "nyc": "^17.1.0",
     "pako": "^2.1.0",
     "passport": "^0.7.0",
     "passport-local": "^1.0.0",
-    "pkg-pr-new": "^0.0.62",
-    "pug": "^3.0.3",
+    "pkg-pr-new": "^0.0.66",
+    "pug": "^3.0.4",
     "response-time": "^2.3.4",
-    "serve-index": "^1.9.1",
+    "serve-index": "^1.9.2",
     "serve-static": "^2.2.1",
+    "supertest": "^7.2.2",
     "swagger-ui-express": "^5.0.1",
     "swig": "^1.4.2",
+    "tsd": "^0.33.0",
     "vhost": "^3.0.2"
   }
 }

package/src/application.js

@@ -22,6 +22,7 @@ const ViewClass = require("./view.js");
 const path = require("path");
 const os = require("os");
 const { Worker } = require("worker_threads");
+const cluster = require('cluster');
 
 const cpuCount = os.cpus().length;
 
@@ -222,18 +223,21 @@ class Application extends Router {
         }
         const onListen = socket => {
             if(!socket) {
-                let err = new Error('Failed to listen on port ' + port + '. No permission or address already in use.');
+                let err = new Error('listen EADDRINUSE: address already in use :::' + port);
+                err.code = 'EADDRINUSE';
                 throw err;
             }
             this.port = uWS.us_socket_local_port(socket);
-            if(callback) callback(this.port);
+            if(callback) callback();
         };
         let fn = 'listen';
         let args = [];
+        // 1 = exclusive port, 0 = shared port
+        let uwsOptions = cluster.isPrimary ? 1 : 0;
         if(typeof port !== 'number') {
             if(!isNaN(Number(port))) {
                 port = Number(port);
-                args.push(port, onListen);
+                args.push(port, uwsOptions, onListen);
                 if(host) {
                     args.unshift(host);
                 }
@@ -242,18 +246,18 @@ class Application extends Router {
                 args.push(onListen, port);
             }
         } else {
-            args.push(port, onListen);
+            args.push(port, uwsOptions, onListen);
             if(host) {
                 args.unshift(host);
             }
         }
         this.listenCalled = true;
         this.uwsApp[fn](...args);
-        return this.uwsApp;
+        return this;
     }
 
     address() {
-        return { port: this.port };
+        return this.port ? { port: this.port } : null;
     }
 
     path() {
@@ -335,6 +339,13 @@ class Application extends Router {
             callback(err);
         }
     }
+
+    close(callback) {
+        if(this.listenCalled) {
+            this.uwsApp.close();
+        } 
+        if(callback) callback();
+    }
 }
 
 module.exports = function(options) {

package/src/declarative.js

@@ -1,10 +1,11 @@
 const acorn = require("acorn");
 const { stringify } = require("./utils.js");
 const uWS = require("uWebSockets.js");
+const statuses = require("statuses");
 
 const parser = acorn.Parser;
 
-const allowedResMethods = ['set', 'header', 'setHeader', 'status', 'send', 'end', 'append'];
+const allowedResMethods = ['set', 'header', 'setHeader', 'sendStatus', 'status', 'send', 'end', 'append'];
 const allowedIdentifiers = ['query', 'params', ...allowedResMethods];
 const objKeyRegex = /[\s{\n]([A-Za-z-0-9_]+)(\s|\n)*?:/g;
 
@@ -203,6 +204,11 @@ module.exports = function compileDeclarative(cb, app) {
                     return false;
                 }
                 headers.push([call.arguments[0].value, call.arguments[1].value]);
+            } else if(call.obj.propertyName === 'sendStatus'){
+                if(call.arguments[0].type !== 'Literal') {  
+                    return false;
+                }
+                statusCode = call.arguments[0].value;
             }
         }
 
@@ -354,13 +360,16 @@ module.exports = function compileDeclarative(cb, app) {
             }
         }
 
-        // uws doesnt support status codes other than 200 currently
+        let decRes = new uWS.DeclarativeResponse();
+
         if(statusCode != 200) {
-            return false;
+            const statusMessage = statuses.message[statusCode] ?? '';
+            decRes = decRes.writeStatus(`${statusCode} ${statusMessage}`.trim());
+            if(!headers.some(header => header[0].toLowerCase() === 'content-type')) {
+                decRes = decRes.writeHeader('content-type','text/plain; charset=utf-8');
+            }
         }
 
-        let decRes = new uWS.DeclarativeResponse();
-
         for(let header of headers) {
             if(header[0].toLowerCase() === 'content-length') {
                 return false;
@@ -390,6 +399,10 @@ module.exports = function compileDeclarative(cb, app) {
             }
         }
 
+        if(!body.length) {
+            decRes = decRes.write(statuses.message[statusCode] || String(statusCode));
+        }
+
         return decRes.end();
     } catch(e) {
         return false;

package/src/request.js

@@ -19,15 +19,16 @@ const accepts = require("accepts");
 const typeis = require("type-is");
 const parseRange = require("range-parser");
 const proxyaddr = require("proxy-addr");
+const { isIP } = require("node:net");
 const fresh = require("fresh");
 const { Readable } = require("stream");
 
-const discardedDuplicates = [
+const discardedDuplicates = new Set([
     "age", "authorization", "content-length", "content-type", "etag", "expires",
     "from", "host", "if-modified-since", "if-unmodified-since", "last-modified",
     "location", "max-forwards", "proxy-authorization", "referer", "retry-after",
     "server", "user-agent"
-];
+]);
 
 let key = 0;
 
@@ -153,19 +154,28 @@ module.exports = class Request extends Readable {
 
     get #host() {
         const trust = this.app.get('trust proxy fn');
-        if(!trust) {
-            return this.get('host');
-        }
-        let val = this.headers['x-forwarded-host'];
-        if (!val || !trust(this.connection.remoteAddress, 0)) {
-            val = this.headers['host'];
-        } else if (val.indexOf(',') !== -1) {
-            // Note: X-Forwarded-Host is normally only ever a
-            //       single value, but this is to be safe.
-            val = val.substring(0, val.indexOf(',')).trimRight()
+        const isTrusted = !!(trust && trust(this.connection.remoteAddress, 0));
+        const rawHeader = (isTrusted && this.headers['x-forwarded-host']) || this.headers['host'];
+        let host = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
+
+        if (typeof host !== 'string' || !host) return;
+        host = host.trim();
+
+        if (isTrusted) {
+            const commaIndex = host.indexOf(',');
+            if (commaIndex !== -1) {
+                // Note: X-Forwarded-Host is normally only ever a
+                //       single value, but this is to be safe.
+                host = host.substring(0, commaIndex).trimEnd();
+            }
         }
-        
-        return val ? val.split(':')[0] : undefined;
+
+        if (!host) return;
+
+        const offset = host[0] === '[' ? host.indexOf(']') + 1 : 0;
+        const portIndex = host.indexOf(':', offset);
+
+        return portIndex !== -1 ? host.substring(0, portIndex) : host;
     }
 
     get host() {
@@ -174,11 +184,7 @@ module.exports = class Request extends Readable {
     }
 
     get hostname() {
-        const host = this.#host;
-        if(!host) return this.headers['host'].split(':')[0];
-        const offset = host[0] === '[' ? host.indexOf(']') + 1 : 0;
-        const index = host.indexOf(':', offset);
-        return index !== -1 ? host.slice(0, index) : host;
+        return this.#host;
     }
 
     get httpVersion() {
@@ -246,18 +252,28 @@ module.exports = class Request extends Readable {
         return this.protocol === 'https';
     }
 
+    #cachedSubdomains = null;
+
     get subdomains() {
-        let host = this.hostname;
-        let subdomains = host.split('.');
-        const so = this.app.get('subdomain offset');
-        if(so === 0) {
-            return subdomains.reverse();
+        if(this.#cachedSubdomains !== null) {
+            return this.#cachedSubdomains;
+        }
+
+        const hostname = this.hostname;
+        if(!hostname || isIP(hostname)) {
+            return this.#cachedSubdomains = [];
         }
-        return subdomains.slice(0, -so).reverse();
+
+        const offset = this.app.get('subdomain offset');
+        const parts = hostname.split('.');
+        const subdomains = parts.reverse().slice(offset);
+
+        return this.#cachedSubdomains = subdomains;
     }
 
     get xhr() {
-        return this.headers['x-requested-with'] === 'XMLHttpRequest';
+        const val = this.headers?.['x-requested-with'];
+        return typeof val === 'string' && val.toLowerCase() === 'xmlhttprequest';
     }
 
     get parsedIp() {
@@ -299,6 +315,7 @@ module.exports = class Request extends Readable {
     get connection() {
         return {
             remoteAddress: this.parsedIp,
+            remotePort: this._res.getRemotePort(),
             localPort: this.app.port,
             encrypted: this.app.ssl,
             end: (body) => this.res.end(body)
@@ -327,6 +344,12 @@ module.exports = class Request extends Readable {
     }
 
     get(field) {
+        if(!field) {
+            throw new TypeError('name argument is required to req.get');
+        }
+        if(typeof field !== 'string') {
+            throw new TypeError('name must be a string to req.get');
+        }
         field = field.toLowerCase();
         if(field === 'referrer' || field === 'referer') {
             const res = this.headers['referrer'];
@@ -355,19 +378,54 @@ module.exports = class Request extends Readable {
         return accepts(this).languages(...languages);
     }
 
-    is(type) {
-        return typeis(this, type);
+    acceptsEncoding(...args) {
+        deprecated('req.acceptsEncoding', 'req.acceptsEncodings');
+        return this.acceptsEncodings(...args);
+    }
+
+    acceptsCharset(...args) {
+        deprecated('req.acceptsCharset', 'req.acceptsCharsets');
+        return this.acceptsCharsets(...args);
+    }
+
+    acceptsLanguage(...args) {
+        deprecated('req.acceptsLanguage', 'req.acceptsLanguages');
+        return this.acceptsLanguages(...args);
+    }
+
+    is(types) {
+        if(Array.isArray(types)) {
+            return typeis(this, types);
+        }
+
+        if(arguments.length === 1) {
+            return typeis(this, [types]);
+        }
+
+        return typeis(this, [...arguments]);
     }
 
     param(name, defaultValue) {
         deprecated('req.param(name)', 'req.params, req.body, or req.query');
-        if(this.params[name]) {
-            return this.params[name];
+
+        if(name == null) return defaultValue;
+
+        if(this.params && Object.prototype.hasOwnProperty.call(this.params, name)) {
+            const value = this.params[name];
+            if(value != null) return value;
         }
-        if(this.body && this.body[name]) {
-            return this.body[name];
+
+        if(this.body && Object.prototype.hasOwnProperty.call(this.body, name)) {
+            const value = this.body[name];
+            if(value != null) return value;
+        }
+
+        if(this.query && Object.prototype.hasOwnProperty.call(this.query, name)) {
+            const value = this.query[name];
+            if(value != null) return value;
         }
-        return this.query[name] ?? defaultValue;
+
+        return defaultValue;
     }
 
     range(size, options) {
@@ -389,7 +447,7 @@ module.exports = class Request extends Readable {
             let [key, value] = this.#rawHeadersEntries[index];   
             key = key.toLowerCase();
             if(this.#cachedHeaders[key]) {
-                if(discardedDuplicates.includes(key)) {
+                if(discardedDuplicates.has(key)) {
                     continue;
                 }
                 if(key === 'cookie') {

package/src/response.js

@@ -18,9 +18,10 @@ const cookie = require("cookie");
 const mime = require("mime-types");
 const vary = require("vary");
 const encodeUrl = require("encodeurl");
-const { 
+const contentDisposition = require("content-disposition");
+const {
     normalizeType, stringify, deprecated, UP_PATH_REGEXP, decode,
-    containsDotFile, isPreconditionFailure, isRangeFresh, NullObject
+    containsDotFile, isPreconditionFailure, isRangeFresh, escapeHtml, NullObject
 } = require("./utils.js");
 const { Writable } = require("stream");
 const { isAbsolute } = require("path");
@@ -70,9 +71,7 @@ class Socket extends EventEmitter {
 module.exports = class Response extends Writable {
     #socket = null;
     #ended = false;
-    #pendingChunks = [];
-    #lastWriteChunkTime = 0;
-    #writeTimeout = null;
+    #pendingCallback = null;
     req;
     constructor(res, req, app) {
         super();
@@ -156,36 +155,21 @@ module.exports = class Response extends Writable {
             }
     
             if (this.chunkedTransfer) {
-                this.#pendingChunks.push(chunk);
-                const size = this.#pendingChunks.reduce((acc, chunk) => acc + chunk.byteLength, 0);
-                const now = performance.now();
-                // the first chunk is sent immediately (!this.#lastWriteChunkTime)
-                // the other chunks are sent when watermark is reached (size >= HIGH_WATERMARK) 
-                // or if elapsed 50ms of last send (now - this.#lastWriteChunkTime > 50)
-                if (!this.#lastWriteChunkTime || size >= HIGH_WATERMARK || now - this.#lastWriteChunkTime > 50) {
-                    this._res.write(Buffer.concat(this.#pendingChunks, size));
-                    this.#pendingChunks = [];
-                    this.#lastWriteChunkTime = now;
-                    if(this.#writeTimeout) {
-                        clearTimeout(this.#writeTimeout);
-                        this.#writeTimeout = null;
-                    }
-                } else if(!this.#writeTimeout) {
-                    this.#writeTimeout = setTimeout(() => {
-                        this.#writeTimeout = null;
-                        if(!this.finished && !this.aborted) this._res.cork(() => {
-                            if(this.#pendingChunks.length) {
-                                const size = this.#pendingChunks.reduce((acc, chunk) => acc + chunk.byteLength, 0);
-                                this._res.write(Buffer.concat(this.#pendingChunks, size));
-                                this.#pendingChunks = [];
-                                this.#lastWriteChunkTime = performance.now();
-                            }
-                        });
-                    }, 50);
-                    this.#writeTimeout.unref();
+                const ok = this._res.write(chunk);
+                if (ok) {
+                    this.writingChunk = false;
+                    callback(null);
+                } else {
+                    this.#pendingCallback = callback;
+                    this._res.onWritable(() => {
+                        if (this.aborted || this.finished) return true;
+                        const cb = this.#pendingCallback;
+                        this.#pendingCallback = null;
+                        this.writingChunk = false;
+                        if (cb) cb(null);
+                        return true;
+                    });
                 }
-                this.writingChunk = false;
-                callback(null);
             } else {
                 const lastOffset = this._res.getWriteOffset();
                 const [ok, done] = this._res.tryEnd(chunk, this.totalSize);
@@ -263,7 +247,7 @@ module.exports = class Response extends Writable {
         return this;
     }
     sendStatus(code) {
-        return this.status(code).send(statuses.message[+code] ?? code.toString());
+        return this.status(code).type('txt').send(statuses.message[code] || String(code));
     }
     end(data, cb) {
         if(typeof data === 'function') {
@@ -311,11 +295,6 @@ module.exports = class Response extends Writable {
             if(!data && contentLength) {
                 this._res.endWithoutBody(contentLength.toString());
             } else {
-                if(this.#pendingChunks.length) {
-                    this._res.write(Buffer.concat(this.#pendingChunks));
-                    this.#pendingChunks = [];
-                    this.lastWriteChunkTime = 0;
-                }
                 if(data instanceof Buffer) {
                     data = data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength);
                 }
@@ -724,8 +703,10 @@ module.exports = class Response extends Writable {
         return this.cookie(name, '', opts);
     }
     attachment(filename) {
-        this.headers['Content-Disposition'] = `attachment; filename="${filename}"`;
-        this.type(filename.split('.').pop());
+        if(filename) {
+            this.type(Path.extname(filename));
+        }
+        this.set('Content-Disposition', contentDisposition(filename));
         return this;
     }
     format(object) {
@@ -740,7 +721,7 @@ module.exports = class Response extends Writable {
         } else if(object.default) {
             object.default(this.req, this, this.req.next);
         } else {
-            this.status(406).send(this.app._generateErrorPage('Not Acceptable'));
+            this.status(406).send(this.app._generateErrorPage('Not Acceptable', this.statusCode, false));
         }
 
         return this;
@@ -787,8 +768,13 @@ module.exports = class Response extends Writable {
         return this.send(body);
     }
     links(links) {
-        this.headers['link'] = Object.entries(links).map(([rel, url]) => `<${url}>; rel="${rel}"`).join(', ');
-        return this;
+        // this.headers['link'] = Object.entries(links).map(([rel, url]) => `<${url}>; rel="${rel}"`).join(', ');
+        // return this;
+        let link = this.get('Link') || '';
+        if(link) link += ', ';
+        return this.set('Link', link + Object.keys(links).map(function(rel){
+            return '<' + links[rel] + '>; rel="' + rel + '"';
+        }).join(', '));
     }
     location(path) {
         if(path === 'back') {
@@ -796,7 +782,8 @@ module.exports = class Response extends Writable {
             if(!path) path = this.req.get('Referer');
             if(!path) path = '/';
         }
-        return this.headers['location'] = encodeUrl(path);
+        this.headers['location'] = encodeUrl(path);
+        return this;
     }
     redirect(status, url, forceHtml = false) {
         if(typeof status !== 'number' && !url) {
@@ -805,6 +792,8 @@ module.exports = class Response extends Writable {
         }
         this.location(url);
         this.status(status);
+
+        const address = this.get('Location');
         let body;
         // Support text/{plain,html} by default
         if(forceHtml) {
@@ -817,18 +806,18 @@ module.exports = class Response extends Writable {
                 '<title>Redirecting</title>\n' +
                 '</head>\n' +
                 '<body>\n' +
-                `<pre>Redirecting to ${url.replaceAll("<", "&lt;").replaceAll(">", "&gt;")}</pre>\n` +
+                `<pre>Redirecting to ${escapeHtml(address)}</pre>\n` +
                 '</body>\n' +
                 '</html>\n';
         } else {
             this.format({
                 text: () => {
                     this.set('Content-Type', 'text/plain; charset=UTF-8');
-                    body = statuses.message[status] + '. Redirecting to ' + url
+                    body = `${statuses.message[status]}. Redirecting to ${address}`;
                 },
                 html: () => {
                     this.set('Content-Type', 'text/html; charset=UTF-8');
-                    body = `<p>${statuses.message[status]}. Redirecting to ${url.replaceAll("<", "&lt;").replaceAll(">", "&gt;")}</p>`;
+                    body = `<p>${statuses.message[status]}. Redirecting to ${escapeHtml(address)}</p>`;
                 },
                 default: () => {
                     this.set('Content-Type', 'text/plain; charset=UTF-8');

package/src/router.js

@@ -35,10 +35,23 @@ const methods = [
     'search', 'subscribe', 'unsubscribe', 'report', 'mkactivity', 'mkcalendar',
     'checkout', 'merge', 'm-search', 'notify', 'subscribe', 'unsubscribe', 'search'
 ];
-const supportedUwsMethods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS', 'HEAD', 'CONNECT', 'TRACE'];
+const supportedUwsMethods = new Set(['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS', 'HEAD', 'CONNECT', 'TRACE']);
 
 const regExParam = /:(\w+)/g;
 
+function generateErrorPageHtml(err) {
+    return `<!DOCTYPE html>\n` +
+        `<html lang="en">\n` +
+        `<head>\n` +
+        `<meta charset="utf-8">\n` +
+        `<title>Error</title>\n` +
+        `</head>\n` +
+        `<body>\n` +
+        `<pre>${err?.stack ?? err}</pre>\n` +
+        `</body>\n` +
+        `</html>\n`;
+}
+
 module.exports = class Router extends EventEmitter {
     parent;
     listenCalled;
@@ -162,7 +175,7 @@ module.exports = class Router extends EventEmitter {
             routes.push(route);
             // normal routes optimization
             if(canBeOptimized(route.path) && route.pattern !== '/*' && !this.parent && this.get('case sensitive routing') && this.uwsApp) {
-                if(supportedUwsMethods.includes(method)) {
+                if(supportedUwsMethods.has(method)) {
                     const optimizedPath = this._optimizeRoute(route, this._routes);
                     if(optimizedPath) {
                         this._registerUwsRoute(route, optimizedPath);
@@ -192,7 +205,7 @@ module.exports = class Router extends EventEmitter {
                                     return; // can only optimize router whos parent is listening
                                 }
                                 for(let cbroute of callback._routes) {
-                                    if(!needsConversionToRegex(cbroute.path) && cbroute.path !== '/*' && supportedUwsMethods.includes(cbroute.method)) {
+                                    if(!needsConversionToRegex(cbroute.path) && cbroute.path !== '/*' && supportedUwsMethods.has(cbroute.method)) {
                                         let optimizedRouterPath = this._optimizeRoute(cbroute, callback._routes);
                                         if(optimizedRouterPath) {
                                             optimizedRouterPath = optimizedRouterPath.slice(0, -1);
@@ -363,6 +376,13 @@ module.exports = class Router extends EventEmitter {
         this._sendErrorPage(request, response, err, true);
     }
 
+    _generateErrorPage(err, statusCode, checkEnv = false) {
+        if(checkEnv && this.get('env') === 'production') {
+            err = statusCode >= 400 ? (statuses.message[statusCode] ?? 'Internal Server Error') : 'Internal Server Error';
+        }
+        return generateErrorPageHtml(err);
+    }
+
     _extractParams(pattern, path) {
         if(path.endsWith('/')) {
             path = path.slice(0, -1);
@@ -647,22 +667,11 @@ module.exports = class Router extends EventEmitter {
     }
 
     _sendErrorPage(request, response, err, checkEnv = false) {
-        if(checkEnv && this.get('env') === 'production') {
-            err = response.statusCode >= 400 ? (statuses.message[response.statusCode] ?? 'Internal Server Error') : 'Internal Server Error';
-        }
+        err = this._generateErrorPage(err, response.statusCode, checkEnv);
         request.noEtag = true;
         response.setHeader('Content-Type', 'text/html; charset=utf-8');
         response.setHeader('X-Content-Type-Options', 'nosniff');
         response.setHeader('Content-Security-Policy', "default-src 'none'");
-        response.send(`<!DOCTYPE html>\n` +
-            `<html lang="en">\n` +
-            `<head>\n` +
-            `<meta charset="utf-8">\n` +
-            `<title>Error</title>\n` +
-            `</head>\n` +
-            `<body>\n` +
-            `<pre>${err?.stack ?? err}</pre>\n` +
-            `</body>\n` +
-            `</html>\n`);
+        response.send(err);
     }
 }

package/src/types.d.ts

@@ -1,5 +1,5 @@
 declare module "ultimate-express" {
-  import e from "@types/express";
+  import e from "express";
   import uWS from "uWebSockets.js";
 
   type Settings = {
@@ -19,7 +19,7 @@ declare module "ultimate-express" {
     export import response = e.response;
 
     export import static = e.static;
-    // export import query = e.query;
+    // export import query = e.query; 
 
     export import urlencoded = e.urlencoded;
 
@@ -45,11 +45,15 @@ declare module "ultimate-express" {
     export import Send = e.Send;
   }
 
+  type UltimateExpressListen = ReturnType<e.Express['listen']> & {
+    uwsApp: uWS.TemplatedApp;
+  };
+
   type UltimateExpress = Omit<e.Express, 'listen'> & {
     readonly uwsApp: uWS.TemplatedApp;
-    listen(port: number, callback?: (token: any) => void): uWS.TemplatedApp;
-    listen(port: number, host: string, callback?: (token: any) => void): uWS.TemplatedApp;
-    listen(callback: (token: any) => void): uWS.TemplatedApp;
+    listen(port: number, callback?: (token: any) => void): UltimateExpressListen;
+    listen(port: number, host: string, callback?: (token: any) => void): UltimateExpressListen;
+    listen(callback: (token: any) => void): UltimateExpressListen;
   };
 
   function express(settings?: Settings): UltimateExpress;

package/src/utils.js

@@ -340,6 +340,52 @@ function isRangeFresh(req, res) {
     return parseHttpDate(lastModified) <= parseHttpDate(ifRange);
 }
 
+function escapeHtml(str) {
+    const s = String(str);
+    const len = s.length;
+    let i = 0;
+
+    // Fast scan: find first char that needs escaping
+    for(; i < len; i++) {
+        const ch = s.charCodeAt(i);
+        if(ch === 0x26 || ch === 0x3C || ch === 0x3E || ch === 0x22 || ch === 0x27) {
+            break;
+        }
+    }
+
+    // No escaping needed
+    if(i === len) return s;
+
+    // Build escaped string from the first match onward
+    let escaped = s.substring(0, i);
+
+    for(; i < len; i++) {
+        const ch = s.charCodeAt(i);
+        switch(ch) {
+            case 0x26: // &
+                escaped += '&amp;';
+                break;
+            case 0x3C: // <
+                escaped += '&lt;';
+                break;
+            case 0x3E: // >
+                escaped += '&gt;';
+                break;
+            case 0x22: // "
+                escaped += '&quot;';
+                break;
+            case 0x27: // '
+                escaped += '&#39;';
+                break;
+            default:
+                escaped += s.charAt(i);
+                break;
+        }
+    }
+
+    return escaped;
+}
+
 // fast null object
 const NullObject = function() {};
 NullObject.prototype = Object.create(null);
@@ -366,5 +412,6 @@ module.exports = {
     findIndexStartingFrom,
     fastQueryParse,
     canBeOptimized,
+    escapeHtml,
     EMPTY_REGEX
 };