Summary

Two correctness bugs found during a code review of the router core, each validated by a regression test that fails on master and passes with the fix.

#1 — prioRequestsProcessing default silently disabled by any config (index.js)

The documented default: true lived only in the parameter default:

module.exports = (config = { prioRequestsProcessing: true }) => { ... }

That default only applies to the zero-arg call. Any real-world call that passes config — zero({ router }), zero({ errorHandler }), zero({ server }) — leaves config.prioRequestsProcessing as undefined (falsy), so the optimization is silently turned off, contradicting the docs/landing-page config table.

The existing prio-request-processing.test.js never caught this because all three cases pass the flag explicitly.

Fix: resolve inside the body — const prioRequestsProcessing = config.prioRequestsProcessing ?? true.

#2 — Cached params shared by reference across requests (lib/router/sequential.js)

router.lookup caches trouter's whole match object (including its params) in the LRU cache (on by default, cacheSize = -1). On a cache hit it assigned req.params = params by reference, so every request to the same method+path shared one mutable object. A non-idempotent middleware mutation bled into later requests.

Demonstrated by the new test: a handler doing req.params.id = req.params.id + '!' on route /item/:id returns x! on the first hit but x!! on the second (shared object) before the fix.

Fix: shallow-copy on assignment — req.params = params ? { ...params } : Object.create(null). The pre-existing else if (params) branch already copied into an existing req.params, so only the direct-assignment path needed the change.

Validation

• New tests/regression-findings.test.js — both tests fail on master (expected undefined to equal true; expected 'x!!' to equal 'x!') and pass with the fix.
• Full suite: 69 passing (was 64), coverage 97% (gate is 85%).
• standard lint clean.

🤖 Generated with Claude Code