@blamejs/blamejs-shop 0.4.85 → 0.4.86

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -1102,6 +1102,11 @@ async function _fetchDmarcRecord(domain, dnsLookup) {
 // throw on malformed v= / unrecognized np= or psd= values rather than
 // silently dropping — operators with a typo'd record otherwise see the
 // fallback policy applied without warning.
+// RFC 7489 §6.3 — p= (and DMARCbis sp=/np=) take exactly one of
+// none|quarantine|reject. p= is REQUIRED; a record without a valid p=
+// carries no usable policy (treat as if no record were published rather
+// than defaulting any unrecognized value to "deliver").
+var DMARC_VALID_P = { none: 1, quarantine: 1, reject: 1 };
 var DMARCBIS_VALID_NP = { none: 1, quarantine: 1, reject: 1 };
 var DMARCBIS_VALID_PSD = { y: 1, n: 1, u: 1 };
 
@@ -1115,8 +1120,22 @@ function _parseDmarcRecord(text) {
     var key = pairs[i][0];
     var val = pairs[i][1];
     if (key === "v")     policy.v = val;
-    else if (key === "p")     policy.p = val.toLowerCase();
-    else if (key === "sp")    policy.sp = val.toLowerCase();
+    else if (key === "p") {
+      var pVal = val.toLowerCase();
+      if (!Object.prototype.hasOwnProperty.call(DMARC_VALID_P, pVal)) {
+        throw new MailAuthError("mail-auth/dmarcbis-bad-tag",
+          "DMARC p= must be one of none|quarantine|reject, got " + JSON.stringify(val));
+      }
+      policy.p = pVal;
+    }
+    else if (key === "sp") {
+      var spVal = val.toLowerCase();
+      if (!Object.prototype.hasOwnProperty.call(DMARC_VALID_P, spVal)) {
+        throw new MailAuthError("mail-auth/dmarcbis-bad-tag",
+          "DMARC sp= must be one of none|quarantine|reject, got " + JSON.stringify(val));
+      }
+      policy.sp = spVal;
+    }
     else if (key === "pct")   policy.pct = parseInt(val, 10);
     else if (key === "adkim") policy.adkim = val.toLowerCase();
     else if (key === "aspf")  policy.aspf = val.toLowerCase();
@@ -1141,6 +1160,16 @@ function _parseDmarcRecord(text) {
     throw new MailAuthError("mail-auth/dmarc-bad-version",
       "DMARC record version must be DMARC1, got " + JSON.stringify(policy.v));
   }
+  // RFC 7489 §6.3 — p= is REQUIRED. A record syntactically valid in
+  // every other respect but missing p= publishes no usable policy; the
+  // receiver MUST treat it as if no record were found rather than
+  // synthesizing a permissive default. Fail closed here so the caller
+  // can route the missing-policy case (none/permerror) instead of
+  // delivering an unauthenticated message.
+  if (policy.p === null) {
+    throw new MailAuthError("mail-auth/dmarc-missing-policy",
+      "DMARC record has no required p= tag (RFC 7489 §6.3)");
+  }
   return policy;
 }
 
@@ -1236,7 +1265,18 @@ async function dmarcEvaluate(opts) {
       }
     }
   } catch (e) {
-    return { result: "temperror", explanation: e.message,
+    // RFC 7489 §6.6.3 — a syntactically invalid / policy-less record is a
+    // PERMANENT error (permerror); only transient DNS resolution failures
+    // are temperror. The DMARC parser raises typed MailAuthError codes for
+    // the permanent cases (bad version, unrecognized tag value, missing
+    // required p=); anything else (DNS lookup) is transient. Either way the
+    // disposition is fail-closed — neither path yields recommendedAction
+    // "deliver".
+    var permanent = e && typeof e.code === "string" &&
+      (e.code === "mail-auth/dmarc-bad-version" ||
+       e.code === "mail-auth/dmarcbis-bad-tag" ||
+       e.code === "mail-auth/dmarc-missing-policy");
+    return { result: permanent ? "permerror" : "temperror", explanation: e.message,
              policy: null, alignment: { spf: false, dkim: false },
              orgDomain: orgDomain };
   }
@@ -1312,13 +1352,23 @@ async function dmarcEvaluate(opts) {
     sampleRoll = bCrypto.randomInt(0, 100);                                                     // pct sample roll
   }
   var sampled = !pass && pct < 100 && sampleRoll >= pct;
-  var recommendedAction = pass ? "deliver" :
-                          sampled
-                            ? (policy.p === "reject" ? "quarantine" :
-                               policy.p === "quarantine" ? "none" : "deliver")
-                            : (policy.p === "reject"     ? "reject" :
-                               policy.p === "quarantine" ? "quarantine" :
-                               "deliver");
+  // Disposition is driven by the validated p= value. policy.p is one of
+  // none|quarantine|reject (the parser fails closed on anything else, so a
+  // missing/typo'd policy never reaches here). "none" is monitor-only →
+  // deliver; reject/quarantine map to their disposition (sampled = the
+  // next-less-strict step per §6.6.4). The explicit "none" arm — rather
+  // than a catch-all "else → deliver" — keeps an unexpected value from
+  // silently delivering a failing message.
+  var recommendedAction;
+  if (pass) {
+    recommendedAction = "deliver";
+  } else if (policy.p === "none") {
+    recommendedAction = "deliver";
+  } else if (sampled) {
+    recommendedAction = policy.p === "reject" ? "quarantine" : "none";       // p is reject|quarantine here
+  } else {
+    recommendedAction = policy.p === "reject" ? "reject" : "quarantine";     // p is reject|quarantine here
+  }
 
   return {
     result:     pass ? "pass" : "fail",
@@ -1544,10 +1594,15 @@ async function arcVerify(rfc822, opts) {
     var asX  = asTags.x  ? parseInt(asTags.x, 10)  : null;
     var skewSec = Math.floor(arcClockSkewMs / 1000);                                          // sec divisor
     var timeFault = null;
-    if (amsT && isFinite(amsT) && amsT - skewSec > nowSec) timeFault = "ams-t-future";
-    if (amsX && isFinite(amsX) && amsX + skewSec < nowSec) timeFault = "ams-x-expired";
-    if (asT  && isFinite(asT)  && asT  - skewSec > nowSec) timeFault = "as-t-future";
-    if (asX  && isFinite(asX)  && asX  + skewSec < nowSec) timeFault = "as-x-expired";
+    // RFC 8617 §5.2 — a PRESENT t=/x= that is unparseable (parseInt → NaN) must
+    // FAIL CLOSED (a time fault), not silently skip the future/expiry check: a
+    // bare `isFinite(amsT) &&` lets a malformed timestamp slip the MUST-reject
+    // gate. Gate on the RAW tag's presence (amsTags.t/x) so an unparseable value
+    // becomes a fault, while an absent tag is correctly ignored.
+    if (amsTags.t && (!isFinite(amsT) || amsT - skewSec > nowSec)) timeFault = isFinite(amsT) ? "ams-t-future" : "ams-t-unparseable";
+    if (amsTags.x && (!isFinite(amsX) || amsX + skewSec < nowSec)) timeFault = isFinite(amsX) ? "ams-x-expired" : "ams-x-unparseable";
+    if (asTags.t  && (!isFinite(asT)  || asT  - skewSec > nowSec)) timeFault = isFinite(asT)  ? "as-t-future"  : "as-t-unparseable";
+    if (asTags.x  && (!isFinite(asX)  || asX  + skewSec < nowSec)) timeFault = isFinite(asX)  ? "as-x-expired" : "as-x-unparseable";
 
     // AMS — RFC 8617 §5.1.1. Same shape as a DKIM-Signature; reuses
     // the DKIM verifier by injecting a temporary message that has

package/lib/vendor/blamejs/lib/mail-bimi.js

@@ -819,6 +819,12 @@ function _verifyCertChain(leaf, intermediates, anchors) {
   while (depth < MAX_DEPTH) {
     var notBefore = Date.parse(current.validFrom);
     var notAfter  = Date.parse(current.validTo);
+    // Fail closed on a present-but-unparseable validity window: a NaN date
+    // would otherwise skip both window checks below and let the cert pass
+    // validation unchecked.
+    if (!isFinite(notBefore) || !isFinite(notAfter)) {
+      return { ok: false, reason: "cert validity dates unparseable" };
+    }
     if (isFinite(notBefore) && now < notBefore) {
       return { ok: false, reason: "cert not-yet-valid (notBefore=" + current.validFrom + ")" };
     }

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -829,6 +829,16 @@ function checkCert(opts) {
   var nowMs = Date.now();
   var notBeforeMs = Date.parse(cert.validFrom);
   var notAfterMs  = Date.parse(cert.validTo);
+  // Fail closed on a present-but-unparseable validity field — gating
+  // each comparison behind isFinite() alone let a NaN notBefore /
+  // notAfter skip both checks and pass validity. RFC 5280 §4.1.2.5
+  // makes both dates mandatory; a date a peer cannot parse must be
+  // refused at preflight, not accepted and left to fail interop later.
+  if (!isFinite(notBeforeMs) || !isFinite(notAfterMs)) {
+    throw new MailCryptoError("mail-crypto/smime/bad-validity",
+      "cert has unparseable validity dates (validFrom=" + cert.validFrom +
+      ", validTo=" + cert.validTo + ")");
+  }
   if (isFinite(notBeforeMs) && nowMs < notBeforeMs) {
     throw new MailCryptoError("mail-crypto/smime/expired-cert",
       "cert is not yet valid (notBefore=" + cert.validFrom + ", now=" +

package/lib/vendor/blamejs/lib/mail-dkim.js

@@ -482,6 +482,36 @@ function _parseDkimTagList(value) {
   return tags;
 }
 
+// RFC 6376 §3.5 — x= / t= / l= are unsigned decimal integers ("1*DIGIT").
+// parseInt() is too lenient here ("12abc" → 12, "0x10" → 0, " 12" → 12),
+// so a present-but-malformed value must not be coerced into a finite
+// number that then passes the downstream check. Returns the parsed integer,
+// or null when the value is not a well-formed unsigned integer — the caller
+// fails CLOSED on null. `maxDigits` bounds the digit count (a ReDoS-free
+// length cap; x=/t= are NumericDate, bounded to 12 digits).
+function _parseDkimUnsignedInt(raw, maxDigits) {
+  if (typeof raw !== "string") return null;
+  var len = raw.length;
+  // "1*DIGIT": non-empty, ASCII 0-9 only, length-capped. A char-code scan
+  // (no regex) keeps this linear and avoids a dynamic RegExp / a shared
+  // digit-pattern literal — maxDigits bounds x=/t=/l= to their NumericDate
+  // / octet-count headroom.
+  if (len === 0 || (maxDigits && len > maxDigits)) return null;
+  for (var i = 0; i < len; i++) {
+    var c = raw.charCodeAt(i);
+    if (c < 0x30 || c > 0x39) return null;   // not an ASCII digit
+  }
+  var n = parseInt(raw, 10);
+  if (!isFinite(n)) return null;
+  return n;
+}
+
+// x= / t= are NumericDate (seconds-since-epoch); 12 digits is ample headroom
+// past any realistic epoch and keeps the parse bounded.
+function _parseDkimNumericDate(raw) {
+  return _parseDkimUnsignedInt(raw, 12);
+}
+
 function _selectorTxtToKeyTags(txtRecords) {
   // DKIM key record is a TXT record at <selector>._domainkey.<domain>.
   // Format: "v=DKIM1; k=rsa; p=<base64>" (chunks may be split across
@@ -694,8 +724,16 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
     // the signature still validates against legitimate senders that
     // use l=, but flag in the result. The cap is octets of the
     // CANONICALIZED body (RFC 6376 §3.4.5), applied inside _bodyHashB64.
-    var parsedL = parseInt(sigTags.l, 10);
-    if (isFinite(parsedL) && parsedL >= 0) lcap = parsedL;
+    // l= is an unsigned decimal integer ("1*DIGIT" per §3.5); a
+    // present-but-unparseable value must FAIL CLOSED rather than fall
+    // through to lcap=undefined (hashing the whole body silently masks the
+    // malformed tag instead of refusing it).
+    var parsedL = _parseDkimUnsignedInt(sigTags.l, 18);
+    if (parsedL === null) {
+      return { result: "permerror",
+               errors: ["DKIM-Signature l= present but unparseable (RFC 6376 §3.5 — unsigned integer required)"] };
+    }
+    lcap = parsedL;
   }
 
   // 1. Body-hash check.
@@ -922,34 +960,49 @@ async function verify(rfc822, opts) {
     // attack). Both are in seconds-since-epoch per ABNF.
     var nowSec = Math.floor(Date.now() / C.TIME.seconds(1));
     var clockSkewSec = Math.floor(clockSkewMs / C.TIME.seconds(1));
+    // x= / t= are NumericDate (digits-only seconds-since-epoch per the
+    // §3.5 ABNF). A present-but-unparseable value must FAIL CLOSED — a NaN
+    // result silently skipping the expiry / future-date / ordering checks
+    // would let verification proceed to result:"pass" with NO expiry
+    // enforced (mirrors the SAML Conditions present-but-unparseable fix).
+    var xSec = null;
     if (sigTags.x !== undefined) {
-      var expSec = parseInt(sigTags.x, 10);
-      if (isFinite(expSec) && expSec + clockSkewSec < nowSec) {
+      xSec = _parseDkimNumericDate(sigTags.x);
+      if (xSec === null) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature x= present but unparseable (RFC 6376 §3.5 — NumericDate required)"] });
+        continue;
+      }
+      if (xSec + clockSkewSec < nowSec) {
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
-          errors: ["DKIM-Signature x=" + expSec + " has expired (RFC 6376 §3.5)"] });
+          errors: ["DKIM-Signature x=" + xSec + " has expired (RFC 6376 §3.5)"] });
         continue;
       }
     }
     if (sigTags.t !== undefined) {
-      var tSec = parseInt(sigTags.t, 10);
+      var tSec = _parseDkimNumericDate(sigTags.t);
+      if (tSec === null) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature t= present but unparseable (RFC 6376 §3.5 — NumericDate required)"] });
+        continue;
+      }
       // Allow up to 24h future-skew; beyond that, refuse — neither
       // operator clock drift nor delivery latency explains a future-
       // dated signing time of more than a day.
-      if (isFinite(tSec) && tSec - (24 * 60 * 60) > nowSec) {                                  // allow:raw-time-literal — 24h future-date sanity ceiling
+      if (tSec - (24 * 60 * 60) > nowSec) {                                                    // allow:raw-time-literal — 24h future-date sanity ceiling
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
           errors: ["DKIM-Signature t=" + tSec + " is more than 24h in the future (RFC 6376 §3.5 sanity)"] });
         continue;
       }
-      if (sigTags.x !== undefined) {
-        var xSec = parseInt(sigTags.x, 10);
-        if (isFinite(xSec) && isFinite(tSec) && xSec < tSec) {
-          results.push({ d: d || null, s: s || null, alg: alg || null,
-            result: "permerror",
-            errors: ["DKIM-Signature x= must be after t= (RFC 6376 §3.5)"] });
-          continue;
-        }
+      if (xSec !== null && xSec < tSec) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature x= must be after t= (RFC 6376 §3.5)"] });
+        continue;
       }
     }
     if (!d || !s) {

package/lib/vendor/blamejs/lib/mail.js

@@ -825,6 +825,16 @@ function smtpTransport(opts) {
   _refuseCtlBytes("host",       opts.host);
   _refuseCtlBytes("servername", opts.servername);
   var timeoutMs = opts.timeoutMs || C.TIME.seconds(15);
+  // Absolute transaction deadline — distinct from the per-socket IDLE
+  // timeout above. A slow-trickle MX that emits one byte just inside
+  // every idle window resets socket.setTimeout forever and never
+  // completes; this wall-clock bound fails the whole send regardless of
+  // trickle. Defaults well above timeoutMs so a normal multi-round-trip
+  // SMTP conversation (greeting → EHLO → STARTTLS → AUTH → MAIL/RCPT →
+  // DATA/BDAT) never trips it.
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxTransactionMs,
+    "smtp transport: opts.maxTransactionMs", MailError, "mail/smtp-misconfigured");
+  var maxTransactionMs = opts.maxTransactionMs || C.TIME.minutes(5);
   var tlsOpts = {
     rejectUnauthorized: rejectUnauthorized,
     minVersion: opts.minTlsVersion || "TLSv1.3",
@@ -875,6 +885,7 @@ function smtpTransport(opts) {
     useImplicitTLS:  useImplicitTLS,
     ehloName:        ehloName,
     timeoutMs:       timeoutMs,
+    maxTransactionMs: maxTransactionMs,
     tlsOpts:         tlsOpts,
     servername:      servername,
     dkimSigner:      opts.dkimSigner || null,
@@ -1043,6 +1054,7 @@ function _smtpSend(message, cfg) {
     var dataWireBytes = null;             // Buffer view of dataMessage for BDAT slicing
     var useBdat = false;                  // Decided post-EHLO based on peerSupportsChunking + cfg.chunkingEnabled
     var bodyMode = "7BIT";                // "7BIT" / "8BITMIME" / "BINARYMIME"
+    var txTimer = null;                   // Absolute transaction-deadline timer (cfg.maxTransactionMs)
 
     var fromAddr = _extractAddr(message.from);
     var toList   = _toArray(message.to).map(_extractAddr);
@@ -1081,9 +1093,13 @@ function _smtpSend(message, cfg) {
       }
     }
 
+    function clearTxTimer() {
+      if (txTimer) { try { clearTimeout(txTimer); } catch (_e) { /* best-effort */ } txTimer = null; }
+    }
     function fail(reason) {
       if (settled) return;
       settled = true;
+      clearTxTimer();
       try { if (socket) socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
       reject(new MailError("mail/smtp-failed",
         "SMTP send failed: " + reason, false));
@@ -1091,6 +1107,7 @@ function _smtpSend(message, cfg) {
     function done(ok, code) {
       if (settled) return;
       settled = true;
+      clearTxTimer();
       try { socket.end(); } catch (_e) { /* socket may already be torn down */ }
       if (ok) resolve({ transport: "smtp", deliveredAt: Date.now(), code: code });
       else reject(new MailError("mail/smtp-rejected",
@@ -1149,6 +1166,16 @@ function _smtpSend(message, cfg) {
 
     function onData(data) {
       buffer += data;
+      // Bound the framing accumulator. A hostile / broken MX that
+      // streams bytes without ever sending CRLF would otherwise grow
+      // `buffer` without limit and OOM the process. SMTP responses are
+      // tiny per spec; the 256 KiB cap is generous headroom. Measure
+      // bytes (not UTF-16 code units) so multibyte trickle can't slip a
+      // larger payload past a char-length check.
+      if (safeBuffer.byteLengthOf(buffer) > MAIL_RESPONSE_MAX_BYTES) {
+        fail("response-too-large");
+        return;
+      }
       var lines = buffer.split("\r\n");
       buffer = lines.pop();
       for (var i = 0; i < lines.length; i++) {
@@ -1233,6 +1260,7 @@ function _smtpSend(message, cfg) {
         // would corrupt NUL-bearing octets in transit.
         if (requiresBinaryMime && !peerSupportsBinaryMime) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/binarymime-not-advertised",
             "message has 8-bit binary content but peer does not advertise BINARYMIME (RFC 3030 §3)",
@@ -1245,6 +1273,7 @@ function _smtpSend(message, cfg) {
         // cap"; -1 means "SIZE not advertised" (no precheck).
         if (cfg.respectPeerSize && peerSizeCap > 0 && messageWireSize > peerSizeCap) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/peer-size-exceeded",
             "message wire size " + messageWireSize + " bytes exceeds peer SIZE cap " +
@@ -1341,6 +1370,7 @@ function _smtpSend(message, cfg) {
         // the chunked-body failure mode.
         if (code !== 250) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/bdat-chunk-rejected",
             "BDAT chunk rejected (code " + code + ", offset " + bdatOffset + "/" +
@@ -1360,6 +1390,15 @@ function _smtpSend(message, cfg) {
       }
     }
 
+    // Arm the absolute transaction deadline before opening the socket so
+    // a peer that connects but then trickles (or never responds) is
+    // bounded regardless of how it games the per-socket idle timer.
+    // unref so a pending deadline never keeps the process alive on its own.
+    txTimer = setTimeout(function () {
+      fail("transaction-timeout");
+    }, cfg.maxTransactionMs);
+    if (txTimer && typeof txTimer.unref === "function") txTimer.unref();
+
     try { connect(); }
     catch (e) { fail(e.message || String(e)); }
   });

package/lib/vendor/blamejs/lib/middleware/api-encrypt.js

@@ -1086,8 +1086,12 @@ function httpClientEncrypted(opts) {
     headers["Content-Type"] = "application/json";
 
     var passThrough = {};
-    var passable = ["allowedProtocols", "allowInternal", "idleTimeoutMs", "maxResponseBytes",
-                    "agent", "errorClass"];
+    // timeoutMs (overall wall-clock cap) and signal (caller cancellation) are
+    // forwarded alongside idleTimeoutMs: without the wall-clock cap a peer that
+    // trickles bytes within the idle window holds the encrypted call open
+    // indefinitely (the plain request path already accepts both).
+    var passable = ["allowedProtocols", "allowInternal", "timeoutMs", "idleTimeoutMs",
+                    "maxResponseBytes", "signal", "agent", "errorClass"];
     for (var i = 0; i < passable.length; i++) {
       if (reqOpts[passable[i]] !== undefined) passThrough[passable[i]] = reqOpts[passable[i]];
     }

package/lib/vendor/blamejs/lib/network-dns-resolver.js

@@ -112,6 +112,7 @@ var networkDns         = require("./network-dns");
 var safeDns            = require("./safe-dns");
 var safeUrl            = require("./safe-url");
 var safeBuffer         = require("./safe-buffer");
+var safeAsync          = require("./safe-async");
 var lazyRequire        = require("./lazy-require");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
@@ -126,6 +127,14 @@ var DEFAULT_MAX_TTL_MS    = C.TIME.hours(24);
 var DEFAULT_MIN_TTL_MS    = C.TIME.seconds(60);
 var DEFAULT_STALE_WINDOW  = C.TIME.hours(6);
 var DEFAULT_PROFILE       = "strict";
+// CWE-400. Per-query wall-clock deadline on the upstream transport
+// lookup. A non-responsive / slow / stalling DoH endpoint (or a
+// transport that sends headers then never ends the body) must not hold
+// the await pending forever — every query() and every followCnames hop
+// is bounded by this, and the default _wireLookup additionally tears
+// the socket down (req.setTimeout) so the fd is released, not just the
+// promise rejected. 10s matches a generous DoH round-trip ceiling.
+var DEFAULT_TIMEOUT_MS    = C.TIME.seconds(10);
 // CWE-400/770. Bound the cache so a hostile peer
 // that can drive query-name selection (e.g. inbound SMTP forwarding
 // DKIM `s=` / `d=` tag-controlled lookups) cannot inflate the Map to
@@ -168,6 +177,7 @@ var QTYPE_BY_NAME = Object.freeze({
  *   maxTtlMs:    number,           // cap any TTL from upstream; default 24h
  *   minTtlMs:    number,           // floor short-TTL records; default 60s
  *   serveStale:  number | false,   // ms to retain expired entries; default 6h
+ *   timeoutMs:   number,           // per-query upstream deadline; default 10s
  *   transport:   { lookup(name, qtype) → Promise<Buffer> },   // operator override
  *   audit:       b.audit namespace,
  *
@@ -187,7 +197,12 @@ function create(opts) {
   var minTtlMs    = typeof opts.minTtlMs === "number" ? opts.minTtlMs : DEFAULT_MIN_TTL_MS;
   var serveStale  = opts.serveStale === false ? 0 :
                     typeof opts.serveStale === "number" ? opts.serveStale : DEFAULT_STALE_WINDOW;
-  var transport   = opts.transport || _defaultTransport();
+  var timeoutMs   = typeof opts.timeoutMs === "number" ? opts.timeoutMs : DEFAULT_TIMEOUT_MS;
+  if (!isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new ResolverError("resolver/bad-input",
+      "create: timeoutMs must be a positive finite number");
+  }
+  var transport   = opts.transport || _defaultTransport(timeoutMs);
   // Audit goes to the operator-supplied sink (opts.audit) when present, else the
   // framework chain — b.audit.namespaced no-ops if the sink has no safeEmit.
   var _baseAudit  = audit().namespaced("network.dns.resolver", { sink: opts.audit });
@@ -276,10 +291,18 @@ function create(opts) {
       return _result(hit.parsed, hit.ttl, true, false, hit.validated);
     }
 
-    // Cache miss / expired — fetch from upstream.
+    // Cache miss / expired — fetch from upstream, bounded by the
+    // per-query wall-clock deadline. withTimeout rejects the await so a
+    // non-responsive / stalling endpoint can't hold the request pending
+    // forever; the default _wireLookup also tears the socket down on its
+    // own req.setTimeout so the underlying fd is released.
     var wireResponse;
     try {
-      wireResponse = await transport.lookup(name, qtype);
+      wireResponse = await safeAsync.withTimeout(
+        Promise.resolve(transport.lookup(name, qtype)),
+        timeoutMs,
+        { name: "dns-resolver:" + name + "/" + qtype }
+      );
     } catch (e) {
       // Upstream failure — serve stale if we have it within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
@@ -425,13 +448,13 @@ function create(opts) {
   };
 }
 
-function _defaultTransport() {
+function _defaultTransport(timeoutMs) {
   // Default transport — compose b.network.dns.useDnsOverHttps()'s
   // existing DoH path. We use the wire-format DoH endpoint directly
   // so the response arrives as raw bytes for safeDns parsing.
   return {
     lookup: function (name, qtype) {
-      return _wireLookup(name, qtype);
+      return _wireLookup(name, qtype, timeoutMs);
     },
   };
 }
@@ -440,7 +463,9 @@ function _defaultTransport() {
 // existing DoH path. Returns the raw response bytes for safeDns to
 // parse. Distinct from the existing network-dns DoH path which returns
 // already-decoded address strings — we need the raw bytes here.
-async function _wireLookup(name, qtype) {
+async function _wireLookup(name, qtype, timeoutMs) {
+  var ms = typeof timeoutMs === "number" && isFinite(timeoutMs) && timeoutMs > 0
+    ? timeoutMs : DEFAULT_TIMEOUT_MS;
   var url = networkDns._getDohUrlForTest ? networkDns._getDohUrlForTest() : "https://cloudflare-dns.com/dns-query";
   // Encode a wire-format query for the target qtype.
   var qbuf = _encodeWireQuery(name, qtype);
@@ -448,6 +473,18 @@ async function _wireLookup(name, qtype) {
   var getUrl = url + (url.indexOf("?") === -1 ? "?" : "&") + "dns=" + b64;
   var u = safeUrl.parse(getUrl, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
   return new Promise(function (resolve, reject) {
+    var settled = false;
+    function _fail(err) {
+      if (settled) return;
+      settled = true;
+      try { req.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+      reject(err);
+    }
+    function _done(buf) {
+      if (settled) return;
+      settled = true;
+      resolve(buf);
+    }
     // Raw DoH wire-format request — bypasses b.httpClient envelope
     // because we need the raw binary response bytes for safeDns to
     // parse (httpClient assumes JSON/text shapes).
@@ -470,18 +507,31 @@ async function _wireLookup(name, qtype) {
       res.on("data", function (c) { if (!pushFailed) { try { collector.push(c); } catch (e) { pushFailed = e; } } });
       res.on("end", function () {
         try {
-          if (pushFailed) { reject(pushFailed); return; }
+          if (pushFailed) { _fail(pushFailed); return; }
           if (res.statusCode !== 200) {                                                                  // HTTP 200 OK
-            reject(new ResolverError("resolver/upstream-http",
+            _fail(new ResolverError("resolver/upstream-http",
               "DoH HTTP " + res.statusCode + " for " + name));
             return;
           }
-          resolve(collector.result());
-        } catch (e) { reject(e); }
+          _done(collector.result());
+        } catch (e) { _fail(e); }
       });
     });
+    // Wall-clock / idle deadline — a DoH endpoint that accepts the
+    // connection, sends 200 headers, then never ends the body would
+    // otherwise hold the socket (and its fd) open indefinitely. setTimeout
+    // arms on socket inactivity; on fire we tear the socket down AND reject
+    // so neither the promise nor the fd leaks (CWE-400 slowloris-style).
+    req.setTimeout(ms, function () {
+      _fail(new ResolverError("resolver/upstream-timeout",
+        "DoH request to " + u.hostname + " for " + name + " exceeded " + ms + "ms"));
+    });
+    req.on("timeout", function () {
+      _fail(new ResolverError("resolver/upstream-timeout",
+        "DoH request to " + u.hostname + " for " + name + " exceeded " + ms + "ms"));
+    });
     req.on("error", function (e) {
-      reject(new ResolverError("resolver/upstream-failed",
+      _fail(new ResolverError("resolver/upstream-failed",
         "DoH request failed: " + e.message));
     });
     req.end();