@blamejs/core 0.15.13 → 0.15.15

package/lib/mail-server-jmap.js

@@ -1138,7 +1138,10 @@ function create(opts) {
         return;
       }
       var text = data.toString("utf8");
-      if (text.length > (opts.webSocketMaxMessageBytes || (10 * 1024 * 1024))) {                       // allow:raw-byte-literal — mirrors handleUpgrade cap
+      // Byte cap measured on the raw frame buffer, not text.length (UTF-16
+      // code units) — a multibyte payload is 2-4x larger in bytes than chars,
+      // so a char-length check under-enforces the limit.
+      if (data.length > (opts.webSocketMaxMessageBytes || (10 * 1024 * 1024))) {                       // allow:raw-byte-literal — mirrors handleUpgrade cap
         _sendRequestError(null,
           "urn:ietf:params:jmap:error:limit",
           "WebSocket message exceeds maxSizeRequest");

package/lib/mail-server-registry.js

@@ -142,7 +142,7 @@ function create(opts) {
   validateOpts.requireNonEmptyString(opts.protocol,
     "b.mail.serverRegistry.create: protocol", MailServerRegistryError,
     "mail-server-registry/bad-protocol");
-  if (!CATALOGUE[opts.protocol]) {
+  if (!Object.prototype.hasOwnProperty.call(CATALOGUE, opts.protocol)) {
     throw new MailServerRegistryError("mail-server-registry/unknown-protocol",
       "create: protocol must be 'imap', 'jmap', or 'managesieve' (got '" + opts.protocol + "')");
   }

package/lib/mail-server-tls.js

@@ -93,6 +93,7 @@ var nodeFs = require("node:fs");
 var nodeTls = require("node:tls");
 var lazyRequire = require("./lazy-require");
 var C = require("./constants");
+var atomicFile = require("./atomic-file");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -177,7 +178,11 @@ function context(opts) {
   var stopped = false;
 
   function _readKey() {
-    var raw = nodeFs.readFileSync(keyFile, "utf8");
+    // Cap + fd-bound TLS-private-key read. NO refuseSymlink: keyFile is commonly
+    // certbot's /etc/letsencrypt/live/<host>/privkey.pem, a symlink chain into
+    // ../../archive — refusing symlinks would break the documented Let's Encrypt
+    // layout. The cap is the OOM-before-use defense.
+    var raw = atomicFile.fdSafeReadSync(keyFile, { maxBytes: C.BYTES.kib(64), encoding: "utf8" });
     // b.vault.sealPemFile produces blobs that decrypt via vault.unseal.
     // Detect by the sealed-cell prefix the framework's vault layer
     // already documents (everything else passes through as plain PEM).
@@ -196,7 +201,9 @@ function context(opts) {
   function _build() {
     var certPem;
     try {
-      certPem = nodeFs.readFileSync(certFile, "utf8");
+      // Cap + fd-bound cert-chain read. NO refuseSymlink (certbot fullchain.pem
+      // is a symlink); the cap is the safe hardening.
+      certPem = atomicFile.fdSafeReadSync(certFile, { maxBytes: C.BYTES.mib(1), encoding: "utf8" });
     } catch (e) {
       throw new MailServerTlsError("mail-server-tls/cert-unreadable",
         "b.mail.server.tls.context: cannot read certFile " + certFile + ": " +

package/lib/mail-spam-score.js

@@ -133,7 +133,7 @@ function create(opts) {
       "mail.spamScore.create.scorer must be a function; got " + (typeof opts.scorer));
   }
   var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
-  if (!PROFILES[profile]) {
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, profile)) {
     throw new MailSpamScoreError("mail-spam-score/bad-profile",
       "mail.spamScore.create.profile: unknown '" + profile +
       "' (valid: strict / balanced / permissive)");
@@ -222,9 +222,7 @@ function create(opts) {
  * @example
  *   b.mail.spamScore.compliancePosture("hipaa");   // → "strict"
  */
-function compliancePosture(posture) {
-  return COMPLIANCE_POSTURES[posture] || null;
-}
+var compliancePosture = gateContract.makePostureAccessor(COMPLIANCE_POSTURES);
 
 function _sanitizeReasons(reasons, caps) {
   if (reasons === undefined || reasons === null) return [];

package/lib/mail-store-fts.js

@@ -321,7 +321,7 @@ var QUERY_KEY_MAP = {
  *   // → { column: "addr_toks", field: "addr" }
  */
 function columnAndFieldFor(key) {
-  return QUERY_KEY_MAP[key] || null;
+  return Object.prototype.hasOwnProperty.call(QUERY_KEY_MAP, key) ? QUERY_KEY_MAP[key] : null;
 }
 
 // Rewrite an operator query term into a FTS5 MATCH expression. The

package/lib/mail.js

@@ -430,6 +430,26 @@ function _validateMessage(message) {
     throw new MailError("mail/invalid-subject",
       "message.subject contains forbidden CRLF", true);
   }
+  // Reply-To and custom header KEYS go straight onto the wire in _buildRfc822;
+  // a CRLF in either smuggles arbitrary headers (Bcc / Reply-To override /
+  // Content-Type) — RFC 5322 / CWE-93 header injection. Fail closed.
+  if (message.replyTo && safeBuffer.hasCrlf(String(message.replyTo))) {
+    throw new MailError("mail/invalid-reply-to",
+      "message.replyTo contains forbidden CRLF (header injection)", true);
+  }
+  if (message.headers && typeof message.headers === "object") {
+    for (var _hk in message.headers) {
+      if (!Object.prototype.hasOwnProperty.call(message.headers, _hk)) continue;
+      if (safeBuffer.hasCrlf(_hk) || _hk.indexOf("\0") !== -1) {
+        throw new MailError("mail/invalid-header",
+          "message.headers key contains forbidden CRLF/NUL (header injection)", true);
+      }
+      if (safeBuffer.hasCrlf(String(message.headers[_hk]))) {
+        throw new MailError("mail/invalid-header",
+          "message.headers value for '" + _hk + "' contains forbidden CRLF (header injection)", true);
+      }
+    }
+  }
 
   if (!message.text && !message.html && !message.calendar) {
     throw new MailError("mail/missing-body",
@@ -711,7 +731,7 @@ function _buildRfc822(message) {
   headers.push("From: " + message.from);
   headers.push("To: " + (Array.isArray(message.to) ? message.to.join(", ") : message.to));
   if (message.cc)      headers.push("Cc: " + (Array.isArray(message.cc) ? message.cc.join(", ") : message.cc));
-  if (message.replyTo) headers.push("Reply-To: " + message.replyTo);
+  if (message.replyTo) headers.push("Reply-To: " + safeBuffer.stripCrlf(String(message.replyTo)));
   if (message.subject) headers.push("Subject: " + message.subject);
   headers.push("MIME-Version: 1.0");
   headers.push("Date: " + new Date().toUTCString());
@@ -721,7 +741,7 @@ function _buildRfc822(message) {
         // Strip CRLF defensively even though we already validated the
         // message; custom headers go straight onto the wire.
         var v = safeBuffer.stripCrlf(String(message.headers[k]));
-        headers.push(k + ": " + v);
+        headers.push(safeBuffer.stripCrlf(String(k)) + ": " + v);
       }
     }
   }

package/lib/markup-tokenizer.js

@@ -48,7 +48,31 @@ function splitTagNameAttrs(inner, tagNameRe) {
   };
 }
 
+// htmlCommentEnd(s, lt) — given that an HTML comment opens at index `lt`
+// (s.startsWith("<!--", lt)), return the index ONE PAST the comment's
+// terminator per the WHATWG HTML tokenizer, not just the legacy "-->" form.
+// A browser also closes a comment at "--!>" (comment-end-bang state) and
+// ABRUPTLY closes one that begins "<!-->" or "<!--->". A scanner that honours
+// only "-->" therefore disagrees with the browser about where the comment
+// ends, so markup AFTER an early "--!>" / abrupt close is swallowed as inert
+// comment by the sanitizer but parsed as a LIVE element by the browser (mXSS,
+// the comment-parser differential). Returns -1 if the comment is unterminated
+// so each caller keeps its own policy (lenient end-of-input vs. fail-closed
+// throw). NOTE: HTML/SVG-in-HTML only — XML comments do NOT have these forms.
+function htmlCommentEnd(s, lt) {
+  var i = lt + 4;                                  // first char after "<!--"
+  if (s.charAt(i) === ">") return i + 1;           // <!--> abrupt close
+  if (s.charAt(i) === "-" && s.charAt(i + 1) === ">") return i + 2;   // <!---> abrupt close
+  var a = s.indexOf("-->", i);
+  var b = s.indexOf("--!>", i);
+  if (a === -1 && b === -1) return -1;             // unterminated
+  if (a === -1) return b + 4;
+  if (b === -1) return a + 3;
+  return a <= b ? a + 3 : b + 4;                   // earliest terminator wins
+}
+
 module.exports = {
   scanToTagEnd: scanToTagEnd,
   splitTagNameAttrs: splitTagNameAttrs,
+  htmlCommentEnd: htmlCommentEnd,
 };

package/lib/mcp.js

@@ -636,10 +636,12 @@ function _validateValueAgainstSchema(value, schema, path) {
     }
     if (typeof schema.pattern === "string") {
       // Schema-supplied pattern — operator-controlled at registration
-      // time, not request-controlled. Cap value length first per the
-      // codebase-patterns regex-bound rule so a 10MB string doesn't
-      // ReDoS the validator.
-      if (value.length > 4096) return path + ": value exceeds 4 KiB cap before regex test";    // 4 KiB regex-input cap
+      // time, not request-controlled. Cap the input LENGTH first per the
+      // codebase-patterns regex-bound rule so a huge string can't ReDoS the
+      // validator. This is a CHARACTER cap, not a byte cap: regex matching
+      // cost scales with the number of code units the engine scans, so 4096
+      // chars is the correct ReDoS bound regardless of UTF-8 byte size.
+      if (value.length > 4096) return path + ": value exceeds 4096-char cap before regex test";    // ReDoS char cap (not bytes)
       try {
         var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern from registered tool author, not request input; bounded above
         if (!pat.test(value)) return path + ": does not match pattern";

package/lib/mdoc.js

@@ -53,6 +53,7 @@ var C = require("./constants");
 var cbor = require("./cbor");
 var cose = require("./cose");
 var bCrypto = require("./crypto");
+var x509Chain = require("./x509-chain");
 var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -128,10 +129,26 @@ function _mapGet(m, k) { return m instanceof Map ? m.get(k) : (m ? m[k] : undefi
  */
 async function verifyIssuerSigned(issuerSigned, opts) {
   validateOpts.requireObject(opts, "mdoc.verifyIssuerSigned", MdocError);
-  validateOpts(opts, ["algorithms", "trustAnchorsPem", "expectedDocType", "at", "maxBytes", "maxDepth"], "mdoc.verifyIssuerSigned");
+  validateOpts(opts, ["algorithms", "trustAnchorsPem", "allowUntrustedIssuer", "expectedDocType", "at", "maxBytes", "maxDepth"], "mdoc.verifyIssuerSigned");
   if (!Array.isArray(opts.algorithms) || opts.algorithms.length === 0) {
     throw new MdocError("mdoc/algorithms-required", "mdoc.verifyIssuerSigned: opts.algorithms is required");
   }
+  // Issuer authentication is the WHOLE point of verifyIssuerSigned. The signer
+  // cert rides in the attacker-supplied x5chain, so verifying the COSE_Sign1
+  // against that embedded key only proves the MSO is self-consistent — a forged
+  // mDL (attacker keypair, self-signed leaf, self-signed MSO) passes unless the
+  // chain is anchored to a configured trust root. Require trustAnchorsPem by
+  // default; an operator who genuinely wants trust-anchor-free verification must
+  // opt in EXPLICITLY (and gets issuerTrusted:false on the result so the
+  // unauthenticated posture is visible). Fail closed — never silently accept an
+  // unanchored issuer.
+  var hasAnchors = opts.trustAnchorsPem !== undefined && opts.trustAnchorsPem !== null;
+  if (!hasAnchors && opts.allowUntrustedIssuer !== true) {
+    throw new MdocError("mdoc/trust-anchors-required",
+      "mdoc.verifyIssuerSigned: opts.trustAnchorsPem is required to authenticate the issuer " +
+      "(the x5chain signer cert is attacker-controlled); pass trustAnchorsPem, or set " +
+      "allowUntrustedIssuer:true to explicitly accept an unauthenticated issuer");
+  }
   validateOpts.optionalDate(opts.at, "mdoc.verifyIssuerSigned: opts.at", MdocError, "mdoc/bad-at");
   var at = (opts.at !== undefined && opts.at !== null) ? opts.at : new Date();
   var decodeOpts = { allowedTags: ALLOWED_TAGS, maxBytes: opts.maxBytes, maxDepth: opts.maxDepth };
@@ -264,6 +281,10 @@ async function verifyIssuerSigned(issuerSigned, opts) {
     deviceKey:    deviceKey,
     signerCert:   signerCert.toString(),
     alg:          verified.alg,
+    // true only when the signer chain was validated against a configured trust
+    // anchor; false on the explicit allowUntrustedIssuer opt-out so a caller
+    // can tell an authenticated issuer from a merely self-consistent MSO.
+    issuerTrusted: hasAnchors,
   };
 }
 
@@ -409,8 +430,10 @@ function _verifyChain(chainDer, anchorsPem, at) {
   throw new MdocError("mdoc/chain-loop", "mdoc.verifyIssuerSigned: certificate chain did not terminate");
 }
 function _issued(issuer, subject) {
-  try { return subject.checkIssued(issuer) && subject.verify(issuer.publicKey); }
-  catch (_e) { return false; }
+  // Enforces basicConstraints cA:TRUE on the issuer alongside the
+  // checkIssued + signature linkage — an IACA/DS chain cannot accept a
+  // non-CA cert as an issuer (basicConstraints bypass, CVE-2002-0862 class).
+  return x509Chain.issuerValidlyIssued(issuer, subject);
 }
 function _assertValidAt(cert, atMs) {
   if (atMs < cert.validFromDate.getTime() || atMs > cert.validToDate.getTime()) {

package/lib/metrics.js

@@ -39,7 +39,6 @@
 
 var C = require("./constants");
 var canonicalJson = require("./canonical-json");
-var nodeFs   = require("node:fs");
 var atomicFile = require("./atomic-file");
 var safeJson = require("./safe-json");
 var { defineClass } = require("./framework-error");
@@ -1067,8 +1066,20 @@ function snapshotRead(p) {
     MetricsError, "metrics-snapshot/bad-path");
   var raw;
   try {
-    raw = nodeFs.readFileSync(p, "utf8");
+    // Capped fd-bound read: the snapshot is parsed AFTER read, so the cap must
+    // precede the alloc — a hostile multi-GB file at the snapshot path would
+    // otherwise OOM the reader before safeJson's 4 MiB parse cap is consulted.
+    raw = atomicFile.fdSafeReadSync(p, {
+      maxBytes: C.BYTES.mib(4), encoding: "utf8", refuseSymlink: true,
+      errorFor: function (kind, detail) {
+        if (kind === "enoent") return new MetricsError("metrics-snapshot/not-found", "metrics.snapshot.read: " + p + " — not found");
+        if (kind === "too-large") return new MetricsError("metrics-snapshot/too-large", "metrics.snapshot.read: " + p + " exceeds " + detail.max + " bytes");
+        if (kind === "symlink") return new MetricsError("metrics-snapshot/symlink-refused", "metrics.snapshot.read: " + p + " is a symlink (refused)");
+        return undefined;
+      },
+    });
   } catch (e) {
+    if (e instanceof MetricsError) throw e;
     throw new MetricsError("metrics-snapshot/not-found",
       "metrics.snapshot.read: " + p + " — " + (e && e.message ? e.message : String(e)));
   }
@@ -1329,7 +1340,7 @@ function shadowRegistry(opts) {
   var gaugeSet   = _shadowSetOf(opts.gauges,   "gauges");
   var infoSet    = _shadowSetOf(opts.info,     "info");
   var cap = opts.cardinalityCap === undefined ? SHADOW_DEFAULT_CARDINALITY : opts.cardinalityCap;
-  if (typeof cap !== "number" || !isFinite(cap) || cap < 1 || Math.floor(cap) !== cap) {
+  if (!numericBounds.isPositiveFiniteInt(cap)) {
     throw new MetricsError("metrics-shadow/bad-cap",
       "shadowRegistry: cardinalityCap must be a positive integer");
   }

package/lib/middleware/api-encrypt.js

@@ -556,7 +556,7 @@ function create(opts) {
           _emitFailure(req, "shape");
           return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
-        if (typeof ctr !== "number" || !isFinite(ctr) || ctr < 0 || Math.floor(ctr) !== ctr) {
+        if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
           _emitFailure(req, "shape");
           return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
@@ -596,7 +596,7 @@ function create(opts) {
         _emitFailure(req, "shape");
         return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }
-      if (!isFinite(ctr) || ctr < 0 || Math.floor(ctr) !== ctr) {
+      if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
         _emitFailure(req, "shape");
         return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }

package/lib/middleware/body-parser.js

@@ -269,13 +269,19 @@ function _contentType(req) {
 }
 
 function _typeMatches(actual, allowed) {
+  var ab = actual.split("/");
   for (var i = 0; i < allowed.length; i++) {
     var a = allowed[i].toLowerCase();
-    // Match either exact type or "type/*" prefix
+    // Exact match, or component-wise wildcard where `*` in either the type or
+    // subtype segment matches any value — so "*/*" (the raw() default) matches
+    // every type, "type/*" matches a whole type, and "*/json" matches a
+    // subtype across types. (A literal indexOf on "*/" never matched a real
+    // Content-Type, which made the "*/*" default reject every request.)
     if (a === actual) return true;
-    var slash = a.indexOf("/");
-    if (slash !== -1 && a.slice(slash + 1) === "*" &&
-        actual.indexOf(a.slice(0, slash + 1)) === 0) return true;
+    var pb = a.split("/");
+    if (pb.length === 2 && ab.length === 2 &&
+        (pb[0] === "*" || pb[0] === ab[0]) &&
+        (pb[1] === "*" || pb[1] === ab[1])) return true;
   }
   return false;
 }

package/lib/middleware/bot-guard.js

@@ -71,17 +71,6 @@ function _coerceAgentPattern(r, where) {
     "in operator code)");
 }
 
-// Bot-guard's "trust the proxy header" semantics for actor.ip — the
-// audit event records the apparent source even when behind a CDN, but
-// only when the operator opts in to trustProxy. Without the opt, we
-// stick to socket.remoteAddress so an attacker-forged XFF can't
-// pollute audit attribution.
-function _xffIpFor(trustProxy) {
-  return function (req) {
-    return requestHelpers.clientIp(req, { trustProxy: trustProxy });
-  };
-}
-
 /**
  * @primitive b.middleware.botGuard
  * @signature b.middleware.botGuard(req, res, next)
@@ -115,7 +104,10 @@ function _xffIpFor(trustProxy) {
  *     bodyOnBlock:   string,
  *     onDeny:        function(req, res, info): void,  // own the block response; info = { status, reason }
  *     problemDetails: boolean,          // default false — emit RFC 9457 application/problem+json instead of text/plain
- *     trustProxy:    boolean|number,
+ *     trustedProxies: string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-For / -Proto
+ *     clientIpResolver: function(req): string|null,    // own the audit-actor IP
+ *     protocolResolver: function(req): "http"|"https", // own the secure-context decision
+ *     trustProxy:    boolean|number,    // legacy; refused unless paired with trustedProxies/resolver (spoofable)
  *   }
  *
  * @example
@@ -131,11 +123,26 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "mode", "onlyForHtml", "allowedAgents", "blockedAgents",
-    "skipPaths", "statusOnBlock", "bodyOnBlock", "onDeny", "problemDetails", "trustProxy",
+    "skipPaths", "statusOnBlock", "bodyOnBlock", "onDeny", "problemDetails",
+    "trustProxy", "trustedProxies", "clientIpResolver", "protocolResolver",
   ], "middleware.botGuard");
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _xffIp = _xffIpFor(trustProxy);
+  // The single trustProxy opt drives two forwarded-header reads: the audit
+  // actor.ip (X-Forwarded-For) and the secure-context check (X-Forwarded-Proto,
+  // see _isSecureContext). Both are peer-gated — declare your reverse proxies
+  // via trustedProxies (CIDRs), or own resolution via clientIpResolver /
+  // protocolResolver. A bare trustProxy is refused: it would trust forgeable
+  // headers from any caller.
+  var _ipResolver, _proto;
+  try {
+    _ipResolver = requestHelpers.trustedClientIp({ trustedProxies: opts.trustedProxies, clientIpResolver: opts.clientIpResolver });
+    _proto      = requestHelpers.trustedProtocol({ trustedProxies: opts.trustedProxies, protocolResolver: opts.protocolResolver });
+  } catch (e) { throw new BotGuardError("bot-guard/bad-opt", e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_ipResolver.peerGated) {
+    throw new BotGuardError("bot-guard/bad-opt",
+      "trustProxy is spoofable — a direct caller could forge X-Forwarded-For / -Proto. Declare " +
+      "your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] or supply clientIpResolver / protocolResolver.");
+  }
+  var _xffIp = _ipResolver.resolve;
   var mode = opts.mode || "block";
   var onlyForHtml = opts.onlyForHtml !== false;
   var allowedAgents = (opts.allowedAgents || []).map(function (r, i) {
@@ -163,9 +170,10 @@ function create(opts) {
   // app, a LAN / *.local reverse-proxy deployment — the browser omits
   // Sec-Fetch-* entirely, so a missing Sec-Fetch-Mode is NORMAL there and
   // must not be read as a bot signal. The effective scheme honours
-  // X-Forwarded-Proto only under trustProxy (otherwise it is forgeable).
+  // X-Forwarded-Proto only from a trusted proxy peer (peer-gated), else the
+  // real TLS socket — a direct caller's forged header is ignored.
   function _isSecureContext(req) {
-    if (requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https") return true;
+    if (_proto.resolve(req) === "https") return true;
     var host = (req.headers && req.headers.host) || "";
     host = String(host).toLowerCase().replace(/:\d+$/, "");   // strip :port
     if (host.charAt(0) === "[") {                              // [::1] IPv6 literal

package/lib/middleware/clear-site-data.js

@@ -113,7 +113,11 @@ function headerValue(types, label) {
   }
   for (var i = 0; i < types.length; i += 1) {
     var t = types[i];
-    if (typeof t !== "string" || !KNOWN_TYPES[t]) {
+    // hasOwnProperty, not `KNOWN_TYPES[t]`: a bracket lookup on the plain-object
+    // allowlist resolves inherited members ("toString" / "constructor" /
+    // "hasOwnProperty") to truthy functions, so those would pass validation and
+    // be emitted as bogus Clear-Site-Data directives (prototype shadowing).
+    if (typeof t !== "string" || !Object.prototype.hasOwnProperty.call(KNOWN_TYPES, t)) {
       throw new TypeError(
         label + ": unknown type '" + t +
         "' (expected one of: " + Object.keys(KNOWN_TYPES).join(", ") + ")");

package/lib/middleware/compose-pipeline.js

@@ -287,6 +287,28 @@ function composePipeline(entries, opts) {
         catch (finalErr) { return reject(finalErr); }
         resolve();
       }
+      // A middleware (or error handler) that ENDS THE RESPONSE without calling
+      // next has halted the chain: it handled the request itself. Settle the
+      // outer promise so the awaiting router is released — a never-settled
+      // promise pins its req/res closure forever — but do NOT call finalNext:
+      // the router's next-flag stays false, so it won't run the route handler
+      // on top of an already-sent response.
+      function _resolveOnce() {
+        if (finished) return;
+        finished = true;
+        resolve();
+      }
+      // Settle when the response actually finishes. This is response-driven,
+      // not return-driven: a callback-style middleware that calls next() LATER
+      // (from a timer, stream, or legacy callback) returns before next() runs,
+      // so we must NOT treat a bare return as a halt — only an ended response.
+      // The synchronous _responseEnded() check below covers a middleware that
+      // ended the response inline (and a mock res without an event emitter);
+      // this listener covers one that ends it from a deferred callback.
+      if (res && typeof res.once === "function") {
+        res.once("finish", _resolveOnce);
+        res.once("close", _resolveOnce);
+      }
       async function dispatch(err) {
         if (finished) return;
         if (idx >= resolved.length) return _finishOnce(err);
@@ -313,14 +335,19 @@ function composePipeline(entries, opts) {
         }
         try {
           if (err) {
-            // Error handler: (err, req, res, next)
+            // Error handler: (err, req, res, next). Express convention — a
+            // 4-arg handler that returns without calling next has HANDLED the
+            // error, so the chain ends cleanly; settle (without finalNext).
             await entry.mw(err, req, res, _next);
-            if (!advanced) _finishOnce();
+            if (!advanced) _resolveOnce();
           } else {
-            // Regular middleware: (req, res, next)
+            // Regular middleware: (req, res, next). Settle only if it ENDED the
+            // response (a halt). A bare return without next is NOT treated as a
+            // halt — it may be a callback-style middleware that calls next()
+            // later (timer/stream); the finish/close listener covers a deferred
+            // response end, and a deferred next() continues the chain.
             await entry.mw(req, res, _next);
-            // 3-arg middleware that doesn't call next — chain halts.
-            // The middleware presumably wrote the response itself.
+            if (!advanced && _responseEnded(res)) _resolveOnce();
           }
         } catch (syncErr) {
           // Synchronous throw OR rejected promise — route through
@@ -334,6 +361,13 @@ function composePipeline(entries, opts) {
   };
 }
 
+// True once the response has been committed/ended — the reliable "this
+// middleware handled the request" signal (vs. the function merely returning,
+// which a callback-style middleware does before its deferred next()).
+function _responseEnded(res) {
+  return !!(res && (res.writableEnded || res.finished || res.headersSent));
+}
+
 composePipeline.CANONICAL_POSITIONS = CANONICAL_POSITIONS;
 composePipeline.ComposePipelineError = ComposePipelineError;
 

package/lib/middleware/compression.js

@@ -328,6 +328,15 @@ function create(opts) {
       // Status precludes body? skip.
       if (NO_BODY_STATUS.has(statusCode)) { compress = false; return; }
 
+      // 206 Partial Content / any Content-Range response must pass through
+      // UNtransformed (RFC 7233 §4.1) — compressing it drops Content-Length but
+      // leaves Content-Range advertising an uncompressed byte interval over a
+      // now-compressed body, corrupting range-assembling clients.
+      if (statusCode === 206) { compress = false; return; }
+      var crRange = (headersObj && headersObj["content-range"]) ||
+                    (originalGetHeader && originalGetHeader("Content-Range"));
+      if (crRange) { compress = false; return; }
+
       // Already compressed by the handler / earlier middleware? skip.
       var existingCE = (headersObj && headersObj["content-encoding"]) ||
                        (originalGetHeader && originalGetHeader("Content-Encoding"));

package/lib/middleware/cors.js

@@ -58,15 +58,6 @@ var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 
-// CORS audit events use the proxy-aware client IP only when the
-// operator opts in via `trustProxy`. Default refuses forwarded
-// headers — same boundary as the rest of the v0.5.3 trustProxy sweep.
-function _xffIpFor(trustProxy) {
-  return function (req) {
-    return requestHelpers.clientIp(req, { trustProxy: trustProxy });
-  };
-}
-
 var CorsError = defineClass("CorsError", { alwaysPermanent: true });
 
 // allowList entries:
@@ -117,17 +108,18 @@ function _canonicalOrigin(input) {
 // supplied. Works for direct deployments (no proxy); operators behind
 // a TLS-terminating proxy that doesn't forward correct Host should set
 // opts.siteOrigin explicitly.
-function _inferRequestOrigin(req, trustProxy) {
+function _inferRequestOrigin(req, protoResolve) {
   if (!req || !req.headers) return null;
   var host = req.headers.host;
   if (!host) return null;
-  // Protocol resolution honors the operator's trustProxy opt — without
-  // it, X-Forwarded-Proto is ignored as attacker-forgeable.
-  var proto = requestHelpers.requestProtocol(req, { trustProxy: trustProxy });
+  // Peer-gated protocol resolution — X-Forwarded-Proto is honored only from a
+  // trusted proxy (else the TLS socket), so a direct caller can't forge the
+  // inferred origin's scheme to slip past the same-origin check.
+  var proto = protoResolve(req);
   return _canonicalOrigin(proto + "://" + host);
 }
 
-function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, strictNullOrigin) {
+function _isSameOrigin(req, originHeader, configuredSiteOrigins, protoResolve, strictNullOrigin) {
   // Origin: null arrives when a browser opaques the Origin (e.g.
   // Referrer-Policy: no-referrer on the page). Sec-Fetch-Site can
   // distinguish the same-origin case, but non-browser clients can forge
@@ -150,10 +142,10 @@ function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, str
     }
     return false;
   }
-  // Fall back to inferring from the request itself. trustProxy threads
-  // through so operators behind a TLS terminator with X-Forwarded-Proto
-  // can opt in to consult the header.
-  var reqOrigin = _inferRequestOrigin(req, trustProxy);
+  // Fall back to inferring from the request itself. The peer-gated protocol
+  // resolver threads through so operators behind a TLS terminator consult
+  // X-Forwarded-Proto only from a trusted peer.
+  var reqOrigin = _inferRequestOrigin(req, protoResolve);
   return reqOrigin !== null && reqOrigin === canonOrigin;
 }
 
@@ -185,7 +177,10 @@ function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, str
  *     maxAgeSeconds:    number,     // default 600
  *     refuseUnknown:    boolean,    // default true
  *     strictNullOrigin: boolean,    // default true
- *     trustProxy:       boolean|number,
+ *     trustedProxies:   string|string[],  // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto for same-origin inference
+ *     protocolResolver: function(req): "http"|"https",  // own the HTTPS decision
+ *     clientIpResolver: function(req): string|null,     // own the audit-actor IP
+ *     trustProxy:       boolean|number,    // legacy; refused unless paired with trustedProxies/resolver (spoofable)
  *     onDeny:           function(req, res, info): void,  // own every refusal; info = { status, reason, origin, header? }
  *     problemDetails:   boolean,    // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
@@ -205,11 +200,25 @@ function create(opts) {
   validateOpts(opts, [
     "origins", "siteOrigin", "methods", "headers", "exposeHeaders",
     "credentials", "maxAgeSeconds", "refuseUnknown", "trustProxy",
+    "trustedProxies", "clientIpResolver", "protocolResolver",
     "strictNullOrigin", "allowPrivateNetwork", "onDeny", "problemDetails",
   ], "middleware.cors");
-  var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
-  var _xffIp = _xffIpFor(trustProxy);
+  // The request scheme feeds the same-origin determination, and a bare
+  // trustProxy trusts a forgeable X-Forwarded-Proto from any caller. Peer-gate
+  // both protocol and the audit-actor IP via trustedProxies (CIDRs) or own them
+  // via protocolResolver / clientIpResolver. A bare trustProxy is refused.
+  var _proto, _ip;
+  try {
+    _proto = requestHelpers.trustedProtocol({ trustedProxies: opts.trustedProxies, protocolResolver: opts.protocolResolver });
+    _ip    = requestHelpers.trustedClientIp({ trustedProxies: opts.trustedProxies, clientIpResolver: opts.clientIpResolver });
+  } catch (e) { throw new CorsError("cors/bad-opt", e.message); }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !_proto.peerGated) {
+    throw new CorsError("cors/bad-opt",
+      "trustProxy is spoofable — a direct caller could forge X-Forwarded-Proto to alter the " +
+      "same-origin decision. Declare your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] " +
+      "or supply protocolResolver(req) / clientIpResolver(req).");
+  }
+  var _xffIp = _ip.resolve;
 
   // Build a canonicalized allowList at create() time. String entries
   // get parsed through _canonicalOrigin so case + default-port
@@ -296,7 +305,7 @@ function create(opts) {
     // Same-origin POST/PUT/etc. carry an Origin header per the Fetch
     // spec but should not be subject to CORS allow-listing — they're
     // the operator's own site talking to itself.
-    if (_isSameOrigin(req, origin, siteOrigins, trustProxy, strictNullOrigin)) return next();
+    if (_isSameOrigin(req, origin, siteOrigins, _proto.resolve, strictNullOrigin)) return next();
 
     var matched = _matchOrigin(origin, origins);
     if (!matched) {