1.1 KiB
Express.js CWE-407 Scan — CLEAN
Project: Express.js
Scanned: lib/ (application.js, express.js, request.js, response.js, utils.js, view.js)
Commit: depth-1 clone of https://github.com/expressjs/express
Date: 2026-03-27
Result: CLEAN — no CWE-407 defects found
Methodology
Scanned all .js files under lib/ for Array.includes(), Array.indexOf(),
Array.find(), and Array.findIndex() calls. Reviewed each hit in context to
determine if it appears inside a loop with a growing array.
Findings
All indexOf() calls found are String.prototype.indexOf() on single string
values — checking for / in content-type strings, ; in param strings, @ in
host strings, etc. These are O(L) on the string length L, not O(N) on a
collection. They are not inside loops that grow the searched collection.
No Array.includes(), Array.find(), or Array.findIndex() calls found.
Express delegates routing entirely to the router npm package (external
dependency), which was not scanned here.
Verdict
Express lib/ is CLEAN for CWE-407. No tickets created.