# Express CWE-407 Scan — CLEAN

**Scan date:** 2026-03-29

## Files scanned

- `lib/application.js` — routing setup, middleware registration
- `lib/request.js` — request parsing helpers
- `lib/response.js` — response formatting helpers
- `lib/utils.js` — ETag, MIME, trust-proxy utilities
- `lib/view.js` — template view resolution
- `lib/express.js` — module entry point

## Findings

- `lib/request.js` — `String.indexOf(',')`, `String.indexOf(':')` calls are single
  O(N) string scans on header values, never inside loops over requests/routes.
- `lib/utils.js` — `type.indexOf('/')` and `str.indexOf(';')` are single-pass
  content-type parser helpers; not called in nested loops.
- `lib/response.js` — `type.indexOf('/')` once per content-type set; no loop.
- `lib/application.js` — `methods.forEach(...)` iterates the 30 HTTP method names
  once at module load time to register route handlers; not called per-request.
- `res.format()` — iterates the caller's key-map once; no inner membership scan.
- Vary header handling delegates to the `vary` npm package (not in-tree).

## Conclusion

No CWE-407 defects found in Express. All `indexOf`/`includes` calls occur in
single-pass string parsing or bounded startup loops, never as inner membership
checks nested inside per-request or per-route loops.