diff --git a/CHANGELOG b/CHANGELOG
index a98b7d9c14..f257990e18 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,9 @@ v3.3.14 (2018-08-15)
 
 * upgraded arangodb starter version to 0.13.1
 
+* fixed issue #5736: Foxx HTTP API responds with 500 error when request body
+  is too short
+
 * fixed issue #5831: custom queries in the ui could not be loaded if the user
   only has read access to the _system database.
 
diff --git a/js/common/modules/@arangodb/util.js b/js/common/modules/@arangodb/util.js
index afcf56a070..97f4a3a760 100644
--- a/js/common/modules/@arangodb/util.js
+++ b/js/common/modules/@arangodb/util.js
@@ -218,5 +218,5 @@ exports.jsonml2xml = function (jsonml, html = false, indentLevel = 0) {
 };
 
 exports.isZipBuffer = function (buffer) {
-  return buffer instanceof Buffer && buffer.utf8Slice(0, 4) === 'PK\u0003\u0004';
+  return buffer instanceof Buffer && buffer.length >= 4 && buffer.utf8Slice(0, 4) === 'PK\u0003\u0004';
 };
diff --git a/js/common/tests/shell/shell-util-spec.js b/js/common/tests/shell/shell-util-spec.js
new file mode 100644
index 0000000000..289470eaac
--- /dev/null
+++ b/js/common/tests/shell/shell-util-spec.js
@@ -0,0 +1,19 @@
+"use strict";
+const util = require("@arangodb/util");
+const { expect } = require("chai");
+
+describe("isZipBuffer", () => {
+  const { isZipBuffer } = util;
+  it("handles empty buffers", () => {
+    const buf = new Buffer(0);
+    expect(isZipBuffer(buf)).to.equal(false);
+  });
+  it("recognizes zip buffers", () => {
+    const buf = new Buffer("PK\u0003\u0004");
+    expect(isZipBuffer(buf)).to.equal(true);
+  });
+  it("does not recognize non-zip buffers", () => {
+    const buf = new Buffer("PK\u0000\u0004");
+    expect(isZipBuffer(buf)).to.equal(false);
+  });
+});