Download Latest Version @tinyhttp_app@3.0.11 source code.zip (507.9 kB)
Email in envelope

Get an email when there's a new version of tinyhttp

Home / @tinyhttp_res@2.2.15
Name Modified Size InfoDownloads / Week
Parent folder
@tinyhttp_res@2.2.15 source code.tar.gz 2026-08-10 370.0 kB
0
@tinyhttp_res@2.2.15 source code.zip 2026-08-10 507.9 kB
0
README.md 2026-08-10 830 Bytes
0
Totals: 3 Items   878.7 kB 0

Patch Changes

  • 0d81969: fix: sanitize default error handler output (GHSA-rqg5-h5qr-gp89)

    The default onErrorHandler reflected attacker-influenced error content (route params, query strings, cookies, etc.) byte-for-byte into the response body with no escaping and no Content-Type, which browsers could MIME-sniff as HTML and execute (reflected XSS).

    • Escape all reflected error content using the existing escapeHTML helper.
    • Always set Content-Type: text/plain; charset=utf-8 and X-Content-Type-Options: nosniff on error responses.
    • Suppress raw error details when NODE_ENV === 'production'.

    escapeHTML is now exported from @tinyhttp/res so it can be reused framework-wide.

  • Updated dependencies [e46a5cc]

    • @tinyhttp/cookie-signature@2.1.2
Source: README.md, updated 2026-08-10