Cache-Control no-transform directive is matched case-sensitively

[kilisamemarisaaa]

Description

compression only recognizes the lowercase spelling of the Cache-Control: no-transform response directive. Other valid casings, such as No-Transform and NO-TRANSFORM, are compressed when the client accepts gzip.

RFC 9111 section 5.2 says cache directives are tokens "to be compared case-insensitively". Section 5.2.2.6 says an intermediary MUST NOT transform a response carrying this directive.

Reproduction

const http = require('http')
const compression = require('compression')

const values = ['no-transform', 'No-Transform', 'NO-TRANSFORM']
const middleware = compression({ threshold: 0 })
const server = http.createServer((req, res) => {
  middleware(req, res, () => {
    res.setHeader('Content-Type', 'text/plain')
    res.setHeader('Cache-Control', decodeURIComponent(req.url.slice(1)))
    res.end('hello world')
  })
})

server.listen(0, '127.0.0.1', async () => {
  for (const value of values) {
    await new Promise((resolve, reject) => {
      http.get({
        host: '127.0.0.1',
        port: server.address().port,
        path: '/' + encodeURIComponent(value),
        headers: { 'Accept-Encoding': 'gzip' }
      }, (res) => {
        console.log(value, res.headers['content-encoding'] || 'none')
        res.resume()
        res.on('end', resolve)
      }).on('error', reject)
    })
  }

  server.close()
})

Current output on master (ae9b1ae):

no-transform none
No-Transform gzip
NO-TRANSFORM gzip

Expected: all three responses have no Content-Encoding header.

Environment

• compression: 1.8.1 / current master (ae9b1ae)
• Node.js: v24.12.0
• OS: Windows 11 (10.0.26200)