diff --git a/meshagent.js b/meshagent.js
index 34088dfe..4d96bc68 100644
--- a/meshagent.js
+++ b/meshagent.js
@@ -116,7 +116,7 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
                 const agentMeshCoreHash = (msg.length == 52) ? msg.substring(4, 52) : null;
 
                 // If the agent indicates this is a custom core, we are done. TODO: Speed up this compare.
-                if (Buffer.from(agentMeshCoreHash, 'binary').toString('hex') == '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000') {
+                if ((agentMeshCoreHash != null) && (Buffer.from(agentMeshCoreHash, 'binary').toString('hex') == '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000')) {
                     obj.agentCoreCheck = 0;
                     obj.send(obj.common.ShortToStr(16) + obj.common.ShortToStr(0)); // MeshCommand_CoreOk. Indicates to the agent that the core is ok. Start it if it's not already started.
                     agentCoreIsStable();
diff --git a/package.json b/package.json
index 876a9f5e..133411ad 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "meshcentral",
-  "version": "0.2.8-s",
+  "version": "0.2.8-u",
   "keywords": [
     "Remote Management",
     "Intel AMT",
diff --git a/webserver.js b/webserver.js
index 322c8d1c..18ed0ced 100644
--- a/webserver.js
+++ b/webserver.js
@@ -2196,7 +2196,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
             // If this domain has configured headers, use them.
             // Example headers: { 'Strict-Transport-Security': 'max-age=360000;includeSubDomains' };
             //                  { 'Referrer-Policy': 'no-referrer', 'x-frame-options': 'SAMEORIGIN', 'X-XSS-Protection': '1; mode=block', 'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src http: ws: data: 'self';script-src http: 'unsafe-inline';style-src http: 'unsafe-inline'" };
-            if ((domain != null) && (domain.httpheaders != null) && (typeof domain.httpheaders == object)) { res.set(domain.httpheaders); }
+            if ((domain != null) && (domain.httpheaders != null) && (typeof domain.httpheaders == 'object')) { res.set(domain.httpheaders); }
 
             // Detect if this is a file sharing domain, if so, just share files.
             if ((domain != null) && (domain.share != null)) {