From 1b6b01630fb3a63649cc7d1edf2a0b301432762e Mon Sep 17 00:00:00 2001
From: hata6502 <7702653+hata6502@users.noreply.github.com>
Date: Sat, 18 Jul 2026 12:16:43 +0900
Subject: [PATCH 1/2] fix: prevent writing after response headers are sent

---
 HISTORY.md   |  1 +
 index.js     |  5 +++++
 test/test.js | 16 ++++++++++++++++
 3 files changed, 22 insertions(+)

diff --git a/HISTORY.md b/HISTORY.md
index 5e36579..eea378e 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==================
 
+  * Prevent writing a response after headers are sent while flushing the request
   * deps: 
     * debug@^4.4.3
     * statuses@^2.0.2
diff --git a/index.js b/index.js
index bf15e48..1c060fb 100644
--- a/index.js
+++ b/index.js
@@ -243,6 +243,11 @@ function getResponseStatusCode (res) {
 
 function send (req, res, status, headers, message) {
   function write () {
+    if (res.headersSent) {
+      debug('cannot %d after headers sent', status)
+      return
+    }
+
     // response body
     var body = createHtmlDocument(message)
 
diff --git a/test/test.js b/test/test.js
index 516e088..677a136 100644
--- a/test/test.js
+++ b/test/test.js
@@ -525,6 +525,22 @@ var topDescribe = function (type, createServer) {
   })
 
   describe('request started', function () {
+    it('should not respond after headers are sent while flushing the request', function (done) {
+      var buf = Buffer.alloc(1024 * 16, '.')
+      var server = createServer(function (req, res) {
+        var final = finalhandler(req, res)
+
+        final()
+        final()
+      })
+
+      var test = wrapper(request(server).post('/foo'))
+      test.write(buf)
+      test.write(buf)
+      test.write(buf)
+      test.expect(404, done)
+    })
+
     it('should not respond', function (done) {
       var server = createServer(function (req, res) {
         var done = finalhandler(req, res)

From e99cc69fbb81f9f23b5b6e68ae5484421ae28156 Mon Sep 17 00:00:00 2001
From: hata6502 <7702653+hata6502@users.noreply.github.com>
Date: Sun, 26 Jul 2026 16:07:19 +0900
Subject: [PATCH 2/2] test: simplify headers sent regression test

---
 test/test.js | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/test/test.js b/test/test.js
index 677a136..966b3e5 100644
--- a/test/test.js
+++ b/test/test.js
@@ -526,19 +526,14 @@ var topDescribe = function (type, createServer) {
 
   describe('request started', function () {
     it('should not respond after headers are sent while flushing the request', function (done) {
-      var buf = Buffer.alloc(1024 * 16, '.')
       var server = createServer(function (req, res) {
-        var final = finalhandler(req, res)
-
-        final()
-        final()
+        finalhandler(req, res)()
+        res.end('respond not by finalhandler')
       })
 
-      var test = wrapper(request(server).post('/foo'))
-      test.write(buf)
-      test.write(buf)
-      test.write(buf)
-      test.expect(404, done)
+      wrapper(request(server)
+        .post('/foo'))
+        .expect(200, 'respond not by finalhandler', done)
     })
 
     it('should not respond', function (done) {