Bug Report: Cannot set property query of #<IncomingMessage> error when using express-mongo-sanitize

[amir-mansoor]

When adding the express-mongo-sanitize middleware to my Express.js application, I encounter the following error:
Cannot set property query of # which has only a getter
This error appears on every screen/request after applying the middleware.
i install the middleware:
npm install express-mongo-sanitize

add it to the express app

import express from 'express';
import mongoSanitize from 'express-mongo-sanitize';

const app = express();
app.use(mongoSanitize());```

Expected Behavior:
The middleware should sanitize req.body, req.query, and req.params without throwing an error.

Current Behavior:
It throws the some error on every request

[rob3rtotrasatti]

I have the same problem in my Express JS application with TypeScript.

The issue seems to be here: code

Library Code:
req[key] = target;

When the express-mongo-sanitize module try to reassign the value on the request, that is based on IncomingMessage class from Node JS.

I think the class is immutable and therefore there is this error.

There are other issues related to this problems. I think for the moment the compatibility of this module with Express 5 is not a priority: issue

I'm following the discussion waiting for advice.

[as3305100]

Same error is also happen with me

[as3305100]

When the solution will come

[christian-schwaderer]

It seems like this happens after updating to Express 5. Experiencing the same issue. To be fair, it says that "express-mongo-sanitize" is a "Express 4.x middleware". But it would be nice anyway to get a fix 🙏

[as3305100]

Yes, I am making LMS backend with payment gateway integration and using some middleware for security. Actually I am a student and learning backend with nodejs.

…

On Tue, May 13, 2025, 13:35 Christian Schwaderer ***@***.***> wrote: *christian-schwaderer* left a comment (fiznool/express-mongo-sanitize#202) <#202 (comment)> It seems like this happens after updating to Express 5. Experiencing the same issue. To be fair, it says that "express-mongo-sanitize" is a "Express *4.x* middleware". But it would be nice anyway to get a fix 🙏 — Reply to this email directly, view it on GitHub <#202 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BHPZZT4S5DUGRJV5KHTUXA326GRUXAVCNFSM6AAAAAB4JWK5MWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQNZVGQ2TQNJTGQ> . You are receiving this because you commented.Message ID: ***@***.***>

[erenbzrgnc]

any solution for this? I don't want to write my own middleware

[hkaya15]

Hello I have same issue. I couldn't use this package. I wrote this package to handle that error. Maybe you can check https://www.npmjs.com/package/mongo-sanitizer

[talatkuyuk]

I wrote https://www.npmjs.com/package/mongo-sanitizer to handle that error.

I've migrated to mongo-sanitizer which works fine ! thank you @hkaya15 ❤

[keyvinvenespana]

Solution :D

// app.js
const express = require('express')
const mongoSanitize = require('express-mongo-sanitize')

const app = express()

app.use(express.json())
app.use(express.urlencoded({ extended: true }))

app.use((req, _res, next) => {
	Object.defineProperty(req, 'query', {
		...Object.getOwnPropertyDescriptor(req, 'query'),
		value: req.query,
		writable: true,
	})

	next()
})

app.use(mongoSanitize())