From 9a871c2b23140767bfb290a52f6c0afa7a74303c Mon Sep 17 00:00:00 2001
From: ANTO JEROME A <antojerome2005@gmail.com>
Date: Wed, 4 Nov 2026 04:19:59 +0530
Subject: [PATCH 1/2] fix: leave the response unchanged when headers are sent
 during the deferred write

Add a check to prevent response after headers are sent.
---
 index.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/index.js b/index.js
index e1e4a6e..b069eef 100644
--- a/index.js
+++ b/index.js
@@ -243,6 +243,12 @@ function getResponseStatusCode (res) {
 
 function send (req, res, status, headers, message) {
   function write () {
+    // cannot actually respond
+    if (res.headersSent) {
+      debug('cannot respond after headers sent')
+      return
+    }
+
     // response body
     var body = createHtmlDocument(message)
 

From 1ba64549fec14202d7039c316288e6ae8b8cff72 Mon Sep 17 00:00:00 2001
From: ANTO JEROME A <antojerome2005@gmail.com>
Date: Wed, 4 Nov 2026 04:20:23 +0530
Subject: [PATCH 2/2] test: add regression test for headers sent during the
 deferred write

Add test for unchanged response when headers are sent during request wait.
---
 test/test.js | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/test/test.js b/test/test.js
index c463b3b..812d91a 100644
--- a/test/test.js
+++ b/test/test.js
@@ -300,6 +300,21 @@ var topDescribe = function (type, createServer) {
   })
 
   describe('error response', function () {
+    it('should leave the response unchanged when headers are sent while waiting for the request', function (done) {
+      var buf = Buffer.alloc(1024 * 1024, '.')
+      var server = createServer(function (req, res, final) {
+        final(createError('oops!'))
+
+        // send the response while finalhandler waits for the request body
+        res.writeHead(200, { 'Content-Type': 'text/plain' })
+        res.end('sent by middleware')
+      })
+      var test = wrapper(request(server).post('/foo'))
+      test.write(buf)
+      test.write(buf)
+      test.expect(200, 'sent by middleware', done)
+    })
+
     it('should include error stack', function (done) {
       wrapper(request(createServer(createError('boom!')))
         .get('/foo'))