fix(deps): update content-type to v3 and read the header string directly

package.json

@@ -85,7 +85,7 @@
     "clean-deep": "^3.4.0",
     "commander": "^12.1.0",
     "comment-json": "^5.0.0",
-    "content-type": "^1.0.5",
+    "content-type": "^3.1.1",
     "cookie": "^2.0.0",
     "cron-parser": "^5.0.0",
     "debug": "^4.4.3",
@@ -158,7 +158,6 @@
     "@tsconfig/node22": "22.0.5",
     "@tsconfig/recommended": "^1.0.13",
     "@types/backoff": "^2.5.5",
-    "@types/content-type": "^1.1.9",
     "@types/debug": "^4.1.12",
     "@types/envinfo": "^7.8.4",
     "@types/eslint-config-prettier": "^6.11.3",

src/lib/functions/form-submissions-handler.ts

@@ -78,7 +78,8 @@ export const createFormSubmissionHandler = function ({
     const originalUrl = new URL(req.url, 'http://localhost')
     req.url = `/.netlify/functions/${handlerName}${originalUrl.search}`
 
-    const ct = parseContentType(req)
+    // A missing header parses to an empty type and takes the unsupported-type branch below.
+    const ct = parseContentType(req.headers['content-type'] ?? '')
     let fields = {}
     let files = {}
     if (ct.type.endsWith('/x-www-form-urlencoded')) {

src/utils/proxy.ts

@@ -20,7 +20,7 @@ import { ServerHandler } from '@netlify/server-dev'
 import { runBeforeProcessExit } from './shell.js'
 import type { AIGatewayContext } from '@netlify/ai/bootstrap'
 import type { MatchResult } from '@netlify/redirect-matcher'
-import contentType from 'content-type'
+import { parse as parseContentType } from 'content-type'
 import generateETag from 'etag'
 import getAvailablePort from 'get-port'
 import httpProxy from 'http-proxy'
@@ -379,7 +379,7 @@ const serveRedirect = async function ({
       return
     }
 
-    const ct = req.headers['content-type'] ? contentType.parse(req).type : ''
+    const ct = parseContentType(req.headers['content-type'] ?? '').type
     if (
       req.method === 'POST' &&
       !isInternal(req.url) &&
@@ -901,7 +901,7 @@ const onRequest = async (
   const hasFormSubmissionHandler: boolean =
     functionsRegistry && getFormHandler({ functionsRegistry, logWarning: false })
 
-  const ct = req.headers['content-type'] ? contentType.parse(req).type : ''
+  const ct = parseContentType(req.headers['content-type'] ?? '').type
   if (
     hasFormSubmissionHandler &&
     functionsServer &&

tests/integration/commands/dev/dev-forms-and-redirects.test.ts

@@ -213,6 +213,49 @@ describe.concurrent('commands/dev-forms-and-redirects', () => {
     })
   })
 
+  test('should keep serving when a form submission carries a malformed content type', async (t) => {
+    await withSiteBuilder(t, async (builder) => {
+      builder
+        .withContentFile({
+          path: 'index.html',
+          content: '<h1>⊂◉‿◉つ</h1>',
+        })
+        .withNetlifyToml({
+          config: {
+            functions: { directory: 'functions' },
+          },
+        })
+        .withFunction({
+          path: 'submission-created.js',
+          handler: async (event: HandlerEvent) =>
+            Promise.resolve({
+              statusCode: 200,
+              body: JSON.stringify(event),
+            }),
+        })
+
+      await builder.build()
+
+      await withDevServer({ cwd: builder.directory }, async (server) => {
+        const response = await fetch(`${server.url}/`, {
+          method: 'POST',
+          body: 'Something',
+          headers: {
+            'content-type': 'not/a valid; ;;',
+          },
+        })
+        t.expect(response.status).toBe(405)
+
+        // node-fetch adds a text/plain Content-Type to a string body; a Buffer body gets none.
+        const withoutHeader = await fetch(`${server.url}/`, { method: 'POST', body: Buffer.from('Something') })
+        t.expect(withoutHeader.status).toBe(405)
+
+        const followUp = await fetch(`${server.url}/`)
+        t.expect(followUp.status).toBe(200)
+      })
+    })
+  })
+
   test('should return existing local file even when rewrite matches when force=false', async (t) => {
     await withSiteBuilder(t, async (builder) => {
       builder