NotificationsYou must be signed in to change notification settings
Fork21.8k
Star68.4k

Fix: Add type validation for sendStatus to prevent BigInt serialization error (#6756)#6758

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Open

Vedant224 wants to merge2 commits intoexpressjs:master

base:master

Choose a base branch

fromVedant224:fix/sendstatus-bigint-error

Open

Fix: Add type validation for sendStatus to prevent BigInt serialization error (#6756)#6758

Vedant224 wants to merge2 commits intoexpressjs:masterfromVedant224:fix/sendstatus-bigint-error

Conversation

Copy link

Vedant224 commentedSep 13, 2025

Fixes#6756

This PR adds type validation tores.sendStatus() to prevent uncaught TypeError when BigInt values are passed as status codes.

Problem:

res.sendStatus(200n) caused uncaught"Do not know how to serialize a BigInt" error
Error occurred whensendStatus() calledthis.status() which internally usesJSON.stringify()

Solution:

Add type checking at the beginning ofsendStatus() method
Throw consistentTypeError: Invalid status code for non-number inputs
Matches existing error handling patterns in Express

Changes:

Add type validation inlib/response.js
Add test case for BigInt input intest/res.sendStatus.js
All existing tests pass (1239 passing)
Follows existing error message format
No linting errors

Testing:

npmtest# All 1239 tests passnpm run lint# No errors

Fix: Add type validation for sendStatus to prevent BigInt serializati…

f48ee1c

…on error (expressjs#6756)- Add type checking in sendStatus() method to throw TypeError for non-number inputs- Prevents uncaught 'Do not know how to serialize a BigInt' error- Add test coverage for BigInt status code input- Maintains backward compatibility with existing error patternsFixesexpressjs#6756

shivarm reviewed

Sep 13, 2025

View reviewed changes

lib/response.js Outdated


		res.sendStatus=functionsendStatus(statusCode){
		if(typeofstatusCode!=='number'){
		thrownewTypeError('Invalid status code: '+statusCode);

Copy link

Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change

	thrownewTypeError('Invalid status code: '+statusCode);
	thrownewTypeError(`statusCode must be a valid number to res.sendStatus`);

I think it seems consistent

Copy link

Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

agree

bjohansebas added the 6.x label

Sep 18, 2025

bjohansebas reviewed

Sep 18, 2025

View reviewed changes

Copy link

Member

bjohansebas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This looks good, although this will be released for version 6 since it would be a breaking change, and we should first release a warning in version 5. Could you create a new PR to add a deprecation message?

Copy link

Author

Vedant224 commentedSep 18, 2025•
edited
Loading

@bjohansebas I've created the deprecation warning PR as requested. I kept it targeting master since that shows my actual 2-file changes cleanly. When I tried changing the target to 5.x it showed 36 changes (difference between branches).

Should I leave it targeting master and you'll handle getting it into Express v5, or would you prefer a different approach for the branch targeting?

The deprecation warning PR is ready for review - it adds the deprecate() call for non-number values in sendStatus().

krzysdz mentioned this pull request

Oct 16, 2025

TypeError: Do not know how to serialize a BigInt when using sendStatus with a BigNum instead of intended error message#6756

Open

abhisekp mentioned this pull request

Oct 22, 2025

fix(sendStatus): prevent BigInt status codes#6839

Closed

3 tasks

Copy link

Contributor

krzysdz commentedOct 29, 2025

This looks good, although this will be released for version 6 since it would be a breaking change, and we should first release a warning in version 5. Could you create a new PR to add a deprecation message?

I don't think that it would be a breaking change - 5.x already includes validation that was added in#4212. This probably could be documented better, because it's mentioned only forres.status (both in migration guide andHistory.md), but the same PR modifiedres.sendStatus to useres.status in order to benefit from this new validation.

The problem with serialization occurs during creation of the validation error message (see#6756 (comment)).

jonchurch requested changes

Dec 12, 2025

View reviewed changes

Copy link

Member

jonchurch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

We centralize our validation for status codes in the.status method whichsendStatus relies on.

Any changes to the validation should happen there.

jonchurch removed the 6.x label

Dec 12, 2025

Copy link

Member

jonchurch commentedDec 12, 2025

Also it's not an uncaught exception, we expect a throw for invalid status and it will be handled.

The enhancement would be the error message change, which makes this a very low prio change IMO.

wesleytodd reviewed

Dec 12, 2025

View reviewed changes

Copy link

Member

wesleytodd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Leaving as a comment since@jonchurch has a blocking review. But once those are changed consider this a ✅ from me.

lib/response.js Outdated

		res.sendStatus=functionsendStatus(statusCode){
		if(typeofstatusCode!=='number'){
		thrownewTypeError('Invalid status code: '+statusCode);
		}

Copy link

Member

wesleytoddDec 12, 2025•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Agreed with@jonchurch, move this tores.status, but throwing forBigInt is the right way to go.

test/res.sendStatus.js Outdated

		request(app)
		.get('/')
		.expect(500,/TypeError.*Invalidstatuscode/,done)
		})

Copy link

Member

wesleytoddDec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This test will need to move tores.status.js after the other change.

fix: prevent BigInt crash and centralize validation in res.status

5338f2c

Copy link

Author

Vedant224 commentedDec 13, 2025

@jonchurch @wesleytodd I've updated the PR to address the feedback.
I moved the validation logic entirely to res.status, and res.sendStatus now calls that internally, so there are no duplicate checks.
I used typeof for the validation because standard string conversion turns 200n into "200", which makes the error message really confusing ("Invalid status code: 200"). By catching it early, we can show the actual issue ("Invalid status code: 200 (bigint)")..
As a side effect of using typeof, all invalid inputs (strings, null, objects) are now including their type in the error message (e.g., 200 (string) or null (object)).
All test cases are passing