Looks like Exploit::CheckCode::Appears fits better here, since as discussed with @jvennix-r7 there are other reasons to get this answer, even on a non vulnerable server. (Example: A web server (no node.js) returning an HTTP "bad method" response)