Combinations of middleware series with "app.all" is broken since 4.18.0

Like all app.METHOD(), app.all() takes callback functions that, according to http://expressjs.com/en/4x/api.html#app.all can be

• A middleware function.
• A series of middleware functions (separated by commas).
• An array of middleware functions.
• A combination of all of the above.

Which should make this example perfectly valid:

const express = require('express');
const app = express();

function mw1 (req, res, next) { next() };
function mw2 (req, res, next) { next() };
function mw3 (req, res, next) { next() };
function mw4 (req, res, next) { next() };
function mw5 (req, res, next) { next() };

app.all('/path',
    mw1, // x
    [
        mw2, // x
        [
            mw3, // x
            mw4 // x
        ],
    ],
    [
        mw5, // x
    ],
    (req, res, next) => res.send('OK')
);

app.use((req, res) => res.status(404).send('Not Found'));
app.listen(3000);

However with express@4.18.0 (and also 4.18.1):

curl -X GET http://localhost:3000/path  # Works ("OK")
curl -X POST http://localhost:3000/path  # Does not work (404)

To make it work with POST, you can either

• Comment out any line with // x
• Change app.all to app.post
• Downgrade to express@4.17.3

This is a major bug for us since it changes the behaviour of app.all in a semver-minor version. I will try to figure out what causes this (must be between express 4.17.3 and 4.18.0).

I see that this is a quite extreme example of nested middleware invocations, but in our case these middlewares (and their combinations) come from different locations such as submodules, and thus cannot be written in a more linear way.

[dougwilson]

Hi @nicokaiser , sorry about that! I didn’t realize this never got released. I will get it released out asap.

[dougwilson]

Ok, so I tracked this down to an issue in the route-handling. It looks like 4.18.1 was a fix for this, but just incomplete. I’ll have a fix pushed up soon 👍