FlowiseAI/Flowise · error · Error

Invalid MIME type: MIME type is required and must be a strin

Error message

Invalid MIME type: MIME type is required and must be a string

What it means

Thrown by validateMimeTypeAndExtensionMatch when the mimetype argument is falsy or not a string. This is a caller-contract violation: the function requires a declared MIME type to compare against the file extension, and an empty/undefined MIME defeats the spoofing check (CVE-2025-61687).

Source

Thrown at packages/components/src/validator.ts:146

    return ext
}

/**
 * Validates that file extension matches the declared MIME type
 *
 * This function addresses CVE-2025-61687 by preventing MIME type spoofing attacks.
 * It ensures that the file extension matches the declared MIME type, preventing
 * attackers from uploading malicious files (e.g., .js file with text/plain MIME type).
 *
 * @param {string} filename The original filename
 * @param {string} mimetype The declared MIME type
 * @returns {void} Throws an error if validation fails
 */
export const validateMimeTypeAndExtensionMatch = (filename: string, mimetype: string): void => {
    validateFilename(filename)

    if (!mimetype || typeof mimetype !== 'string') {
        throw new Error('Invalid MIME type: MIME type is required and must be a string')
    }

    const normalizedExt = extractFileExtension(filename)

    if (!normalizedExt) {
        // Files without extensions are rejected for security
        throw new Error('File type not allowed: files must have a valid file extension')
    }

    // Get the expected extension from mapMimeTypeToExt (returns extension without dot)
    const expectedExt = mapMimeTypeToExt(mimetype)

    if (!expectedExt) {
        // If mapMimeTypeToExt doesn't recognize the MIME type, it's not supported
        throw new Error(`MIME type "${mimetype}" is not supported or does not have a valid file extension mapping`)
    }

    // Ensure the file extension matches the expected extension for the MIME type

View on GitHub (pinned to abe4a8601a)

Solutions

1. Ensure the upload middleware (multer) is configured to detect mimetype and that req.file.mimetype is populated.
2. Validate mimetype presence at the handler boundary and return 400 when missing.
3. Pass req.file.mimetype explicitly to validateMimeTypeAndExtensionMatch.

Example fix

// before
validateMimeTypeAndExtensionMatch(filename, mimetype)

// after — guard at handler
if (!req.file?.mimetype) {
  return res.status(400).json({ error: 'File MIME type could not be determined' })
}
validateMimeTypeAndExtensionMatch(req.file.originalname, req.file.mimetype)

function isNonEmptyMimeType(v: unknown): v is string {
  return typeof v === 'string' && v.trim().length > 0 && v.includes('/')
}

function isValidMimeType(v: unknown): v is string {
  return typeof v === 'string' && /^\w+\/[\w.+-]+$/i.test(v.trim())
}

if (!isValidMimeType(mimetype)) {
  throw new Error('Invalid MIME type: MIME type is required and must be a string')
}

When it happens

Trigger: The upload middleware didn't populate file.mimetype (malformed multipart, missing Content-Type header); caller passed req.file.mimetype which is undefined; programmatic call omitted the mimetype argument.

Common situations: Multipart part without a Content-Type field; a custom upload handler that doesn't set mimetype; refactoring that renamed the field; test fixtures that omit mimetype.

Related errors

• Invalid filename: filename is required and must be a string
• File type not allowed: files must have a valid file extensio
• MIME type "${mimetype}" is not supported or does not have a
• Invalid filename: unsafe characters or path traversal attemp
• MIME type mismatch: file extension "${normalizedExt}" does n

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/c5d26e8aa4045a3d. Report an issue: GitHub.