@blamejs/core 0.15.13 → 0.15.15

package/lib/audit-tools.js

@@ -58,6 +58,7 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var pkg = require("../package.json");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
 var auditChain = require("./audit-chain");
 var canonicalJson = require("./canonical-json");
 var auditSign = require("./audit-sign");
@@ -349,6 +350,12 @@ async function _defaultReadPredecessorRowHash(firstCounter) {
 async function _buildBundle(args) {
   var kind         = args.kind;
   var rows         = args.rows;
+  // Verification witnesses: the rows between the purgeable slice's tip and
+  // the covering checkpoint's anchored counter. They ride the bundle so the
+  // chain can be walked up to the SIGNED atRowHash, but they are NOT part of
+  // the purgeable range (the manifest range below is computed from `rows`,
+  // and purge() only deletes [first..lastCounter]).
+  var witnessRows  = args.witnessRows || [];
   var checkpoint   = args.checkpoint || null;
   var passphrase   = args.passphrase;
   var predecessorRowHash = args.predecessorRowHash;
@@ -357,8 +364,9 @@ async function _buildBundle(args) {
   var lastRow  = rows[rows.length - 1];
   var files = {};
 
-  // 1. Encrypt the rows JSONL
-  var jsonl = rows.map(function (r) {
+  // 1. Encrypt the rows JSONL — purgeable slice followed by any witnesses
+  // (contiguous, ascending) so the verifier walks one unbroken chain.
+  var jsonl = rows.concat(witnessRows).map(function (r) {
     return JSON.stringify(_rowToWireForm(r));
   }).join("\n") + "\n";
   var rowsEnc = await backupCrypto.encryptWithFreshSalt(jsonl, passphrase);
@@ -437,26 +445,39 @@ async function _readBundle(inDir, passphrase) {
       "bundle directory does not exist: " + inDir);
   }
   var manifestPath = nodePath.join(inDir, "manifest.json");
-  if (!nodeFs.existsSync(manifestPath)) {
-    throw new AuditToolsError("audit-tools/no-manifest",
-      "manifest.json missing in " + inDir);
-  }
-  var manifest = safeJson.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+  // Capped fd-bound read (no existsSync check-then-read window): an externally-
+  // supplied bundle manifest is parsed before verification, so an oversized
+  // manifest.json would OOM the verifier before safeJson sees it. 4 MiB is far
+  // above any real manifest.
+  var manifest = safeJson.parse(atomicFile.fdSafeReadSync(manifestPath, {
+    maxBytes: C.BYTES.mib(4), encoding: "utf8",
+    errorFor: function (kind, detail) {
+      if (kind === "enoent") return new AuditToolsError("audit-tools/no-manifest", "manifest.json missing in " + inDir);
+      if (kind === "too-large") return new AuditToolsError("audit-tools/bad-format", "manifest.json too large (" + detail.size + " > " + detail.max + ")");
+      return new AuditToolsError("audit-tools/bad-format", "manifest.json unreadable: " + kind);
+    },
+  }), { maxBytes: C.BYTES.mib(4) });
   if (!manifest || manifest.format !== BUNDLE_FORMAT) {
     throw new AuditToolsError("audit-tools/bad-format",
       "manifest.format is not " + BUNDLE_FORMAT);
   }
-  if (!VALID_KINDS[manifest.kind]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_KINDS, manifest.kind)) {
     throw new AuditToolsError("audit-tools/bad-kind",
       "manifest.kind must be one of " + Object.keys(VALID_KINDS).join(", "));
   }
 
   var rowsEncPath = nodePath.join(inDir, frameworkFiles.fileName("rowsEnc"));
-  if (!nodeFs.existsSync(rowsEncPath)) {
-    throw new AuditToolsError("audit-tools/no-rows-blob",
-      "rows.enc missing in " + inDir);
-  }
-  var rowsEnc = nodeFs.readFileSync(rowsEncPath);
+  // Capped fd-bound read: rows.enc is the PQC-encrypted archived audit slice
+  // (can be large); a hostile multi-GB blob would be read + decrypted in memory
+  // before the checksum check. 512 MiB ceiling bounds it (opt-tunable).
+  var rowsEnc = atomicFile.fdSafeReadSync(rowsEncPath, {
+    maxBytes: C.BYTES.mib(512),
+    errorFor: function (kind) {
+      if (kind === "enoent") return new AuditToolsError("audit-tools/no-rows-blob", "rows.enc missing in " + inDir);
+      if (kind === "too-large") return new AuditToolsError("audit-tools/rows-too-large", "rows.enc exceeds the bundle size cap");
+      return new AuditToolsError("audit-tools/no-rows-blob", "rows.enc unreadable: " + kind);
+    },
+  });
   if (manifest.checksum && manifest.checksum.rowsSha3_512 &&
       backupCrypto.checksum(rowsEnc) !== manifest.checksum.rowsSha3_512) {
     throw new AuditToolsError("audit-tools/rows-checksum-mismatch",
@@ -470,11 +491,16 @@ async function _readBundle(inDir, passphrase) {
   var checkpoint = null;
   if (manifest.kind === KIND_ARCHIVE) {
     var ckptPath = nodePath.join(inDir, frameworkFiles.fileName("checkpointEnc"));
-    if (!nodeFs.existsSync(ckptPath)) {
-      throw new AuditToolsError("audit-tools/no-checkpoint-blob",
-        "checkpoint.enc missing in " + inDir + " (archive bundles must include the covering checkpoint)");
-    }
-    var ckptEnc = nodeFs.readFileSync(ckptPath);
+    // Capped fd-bound read: checkpoint.enc is a single PQC-encrypted
+    // audit_checkpoints row (a few KiB); 4 MiB bounds a hostile blob.
+    var ckptEnc = atomicFile.fdSafeReadSync(ckptPath, {
+      maxBytes: C.BYTES.mib(4),
+      errorFor: function (kind) {
+        if (kind === "enoent") return new AuditToolsError("audit-tools/no-checkpoint-blob", "checkpoint.enc missing in " + inDir + " (archive bundles must include the covering checkpoint)");
+        if (kind === "too-large") return new AuditToolsError("audit-tools/checkpoint-too-large", "checkpoint.enc exceeds the cap");
+        return new AuditToolsError("audit-tools/no-checkpoint-blob", "checkpoint.enc unreadable: " + kind);
+      },
+    });
     if (manifest.checksum && manifest.checksum.checkpointSha3_512 &&
         backupCrypto.checksum(ckptEnc) !== manifest.checksum.checkpointSha3_512) {
       throw new AuditToolsError("audit-tools/checkpoint-checksum-mismatch",
@@ -562,10 +588,31 @@ async function archive(opts) {
 
   var predecessorRowHash = await readPredecessorHash(firstCounter);
 
+  // The signed checkpoint is the bundle's only unforgeable anchor; it commits
+  // the row at checkpoint.atMonotonicCounter. When that counter sits BEYOND
+  // the purgeable slice's tip (the operator archived a subset older than the
+  // last checkpoint), carry the in-between rows as verification witnesses so
+  // verifyBundle can chain-walk up to the anchored row and bind atRowHash to
+  // it. Without them an attacker could pair any genuine high-counter
+  // checkpoint with a wholly fabricated slice. The witnesses are NOT purged.
+  var anchorCounter = Number(checkpoint.atMonotonicCounter);
+  var witnessRows = [];
+  if (anchorCounter > lastCounter) {
+    witnessRows = await readRows({ firstCounter: lastCounter + 1, lastCounter: anchorCounter });
+    var witnessTip = witnessRows.length ? Number(witnessRows[witnessRows.length - 1].monotonicCounter) : null;
+    if (witnessTip !== anchorCounter) {
+      throw new AuditToolsError("audit-tools/anchor-rows-missing",
+        "archive: covering checkpoint anchors counter=" + anchorCounter +
+        " but the rows up to it are not all available (read up to " + witnessTip +
+        ") — cannot prove the slice chains to the signed anchor");
+    }
+  }
+
   if (returnBytes) {
     var built = await _buildBundle({
       kind:       KIND_ARCHIVE,
       rows:       rows,
+      witnessRows: witnessRows,
       checkpoint: checkpoint,
       passphrase: opts.passphrase,
       predecessorRowHash: predecessorRowHash,
@@ -582,6 +629,7 @@ async function archive(opts) {
     outDir:     opts.out,
     kind:       KIND_ARCHIVE,
     rows:       rows,
+    witnessRows: witnessRows,
     checkpoint: checkpoint,
     passphrase: opts.passphrase,
     predecessorRowHash: predecessorRowHash,
@@ -769,26 +817,41 @@ async function verifyBundle(opts) {
     };
   }
 
-  // 2. Confirm the stored firstRowHash + lastRowHash match the slice
+  // 2. Confirm the stored firstRowHash + lastRowHash match the PURGEABLE
+  // slice boundary. The slice tip is the row at range.lastCounter — not
+  // necessarily the physical last row, which may be a verification witness
+  // carried past the slice so the chain can reach the signed checkpoint.
+  var lastCounterN = Number(read.manifest.range.lastCounter);
+  var sliceLastRow = null;
+  for (var ri = 0; ri < read.rows.length; ri++) {
+    if (Number(read.rows[ri].monotonicCounter) === lastCounterN) { sliceLastRow = read.rows[ri]; break; }
+  }
   if (read.rows[0].rowHash !== read.manifest.range.firstRowHash) {
     return {
       ok: false, kind: read.manifest.kind, rowsVerified: read.rows.length,
       reason: "manifest.range.firstRowHash does not match first row's rowHash",
     };
   }
-  if (read.rows[read.rows.length - 1].rowHash !== read.manifest.range.lastRowHash) {
+  if (!sliceLastRow || sliceLastRow.rowHash !== read.manifest.range.lastRowHash) {
     return {
       ok: false, kind: read.manifest.kind, rowsVerified: read.rows.length,
-      reason: "manifest.range.lastRowHash does not match last row's rowHash",
+      reason: "manifest.range.lastRowHash does not match the slice row at lastCounter",
     };
   }
 
-  // 3. (archive only) verify the covering checkpoint signature
+  // 3. (archive only) verify the covering checkpoint signature AND bind its
+  // anchored rowHash to the slice. The signature alone proves only that a
+  // checkpoint exists for some (counter, rowHash); without binding atRowHash
+  // to the archived rows, any genuine high-counter checkpoint could be paired
+  // with a wholly fabricated slice. The row at checkpoint.atMonotonicCounter
+  // must be present in the bundle (slice or witness) and its rowHash must
+  // equal checkpoint.atRowHash — mirroring b.audit.verifyCheckpoints against
+  // the live table.
   if (read.manifest.kind === KIND_ARCHIVE) {
     if (!read.checkpoint) {
       return { ok: false, kind: KIND_ARCHIVE, reason: "checkpoint missing from archive bundle" };
     }
-    if (Number(read.checkpoint.atMonotonicCounter) < Number(read.manifest.range.lastCounter)) {
+    if (Number(read.checkpoint.atMonotonicCounter) < lastCounterN) {
       return {
         ok: false, kind: KIND_ARCHIVE,
         reason: "checkpoint atMonotonicCounter (" + read.checkpoint.atMonotonicCounter +
@@ -805,6 +868,28 @@ async function verifyBundle(opts) {
         };
       }
     }
+    // Bind: the row the signature anchors must be in the bundle and match.
+    var anchorCounterN = Number(read.checkpoint.atMonotonicCounter);
+    var anchoredRow = null;
+    for (var ai = 0; ai < read.rows.length; ai++) {
+      if (Number(read.rows[ai].monotonicCounter) === anchorCounterN) { anchoredRow = read.rows[ai]; break; }
+    }
+    if (!anchoredRow) {
+      return {
+        ok: false, kind: KIND_ARCHIVE,
+        reason: "checkpoint anchors counter=" + anchorCounterN +
+                " but no such row is present in the bundle — checkpoint not bound to the archived slice",
+      };
+    }
+    if (anchoredRow.rowHash !== read.checkpoint.atRowHash) {
+      return {
+        ok: false, kind: KIND_ARCHIVE,
+        reason: "checkpoint atRowHash does not match the bundle row at counter=" + anchorCounterN +
+                " — the signed anchor does not bind this slice",
+        expected: read.checkpoint.atRowHash,
+        actual:   anchoredRow.rowHash,
+      };
+    }
   }
 
   return {

package/lib/audit.js

@@ -797,7 +797,12 @@ async function query(criteria) {
   if (criteria.resourceKind)    q = q.where({ resourceKind: criteria.resourceKind });
   if (criteria.outcome)         q = q.where({ outcome: criteria.outcome });
 
-  q.orderBy("monotonicCounter", "asc");
+  // order: "asc" (default, chronological) | "desc" (newest-first). A capped
+  // query (limit set) returns the FIRST `limit` rows in this order — so a
+  // consumer that wants the most RECENT events under a cap (e.g. the daily
+  // review) must pass order:"desc", else `limit` keeps the OLDEST and drops the
+  // newest events in the window.
+  q.orderBy("monotonicCounter", criteria.order === "desc" ? "desc" : "asc");
   if (criteria.limit  != null)  q.limit(criteria.limit);
   if (criteria.offset != null)  q.offset(criteria.offset);
 
@@ -834,7 +839,7 @@ async function _queryCluster(criteria) {
   if (criteria.resourceKind) qb.where("resourceKind", criteria.resourceKind);
   if (criteria.outcome)      qb.where("outcome", criteria.outcome);
 
-  qb.orderBy("monotonicCounter", "asc");
+  qb.orderBy("monotonicCounter", criteria.order === "desc" ? "desc" : "asc");
   if (criteria.limit  != null) qb.limit(criteria.limit);
   if (criteria.offset != null) qb.offset(criteria.offset);
 

package/lib/auth/access-lock.js

@@ -54,7 +54,7 @@ var SAFE_METHODS = Object.freeze({ GET: 1, HEAD: 1, OPTIONS: 1 });
 function _normalizeMode(mode) {
   if (typeof mode !== "string") return null;
   var m = mode.toLowerCase();
-  return VALID_MODES[m] ? m : null;
+  return Object.prototype.hasOwnProperty.call(VALID_MODES, m) ? m : null;
 }
 
 function create(opts) {
@@ -164,7 +164,7 @@ function create(opts) {
       if (_hasUnlockRole(req)) return next();
       if (currentMode === "read-only") {
         var method = (req.method || "GET").toUpperCase();
-        if (SAFE_METHODS[method]) return next();
+        if (Object.prototype.hasOwnProperty.call(SAFE_METHODS, method)) return next();
         _emitAudit("refused", "denied", { mode: currentMode, method: method, path: req.url });
         _emitMetric("refused", 1, { mode: currentMode, reason: "non-safe-method" });
         return _refuse(res, "non-safe-method-in-read-only");

package/lib/auth/bot-challenge.js

@@ -343,7 +343,7 @@ function create(opts) {
   var secret = opts.secret;
 
   var providerKey = opts.provider !== undefined ? opts.provider : DEFAULT_PROVIDER;
-  if (typeof providerKey !== "string" || !PROVIDERS[providerKey]) {
+  if (typeof providerKey !== "string" || !Object.prototype.hasOwnProperty.call(PROVIDERS, providerKey)) {
     var supported = Object.keys(PROVIDERS).join(", ");
     throw new BotChallengeError("bot-challenge/bad-opt",
       "provider: expected one of [" + supported + "], got " + JSON.stringify(providerKey));

package/lib/auth/ciba.js

@@ -162,6 +162,10 @@ function create(opts) {
     tokenEndpoint:                     opts.tokenEndpoint,
     httpClientOpts:                    opts.httpClientOpts,
     allowHttp:                         opts.allowHttp === true,
+    // Thread the SSRF opt-in through to the inner client's discovery / JWKS /
+    // token fetches — an operator with an internal-network IdP needs it, and
+    // dropping it silently made allowInternal an accepted-but-ignored option.
+    allowInternal:                     opts.allowInternal,
     isOidc:                            true,
   });
 
@@ -452,6 +456,45 @@ function create(opts) {
     });
   }
 
+  // Verify an OIDC ID token (if present) via the composed inner OAuth client,
+  // returning its verified claims, or null when no id_token was supplied. A
+  // present-but-invalid id_token throws (fail-closed) so a forged token's
+  // sub/acr/amr can never be returned as trusted.
+  async function _verifyIdTokenIfPresent(idToken, auditKey, op, expectedAuthReqId) {
+    if (!idToken) return null;
+    var verified;
+    try {
+      verified = await inner.verifyIdToken(idToken);
+    } catch (e) {
+      _emitAudit("id_token_verify_fail", "failure",
+        auditKey ? { authReqIdHash: sha3Hash(auditKey) } : {});
+      throw new AuthError("auth-ciba/id-token-invalid",
+        "ciba." + op + ": id_token failed verification: " +
+        ((e && e.code) || (e && e.message) || String(e)));
+    }
+    // OpenID CIBA Core §7.3 / §10.1: the ID Token MUST carry the
+    // urn:openid:params:jwt:claim:auth_req_id claim and the RP MUST verify it
+    // equals the auth_req_id this flow used. Without it, an id_token minted for
+    // a DIFFERENT auth_req_id (another user's CIBA flow at the same RP) could be
+    // substituted — cross-user token substitution. verifyIdToken returns
+    // { header, claims }, so the claim lives on `.claims`. Constant-time compare.
+    // idToken is present (we returned early if not), so the binding is
+    // MANDATORY and ALWAYS checked — never gated behind a truthiness test that
+    // an empty string could slip. Both call sites pass a non-empty auth_req_id
+    // (validated at the parseNotification / pollToken entry), so a falsy value
+    // can't reach here to skip the comparison.
+    var payload = verified && verified.claims;
+    var boundId = payload && payload["urn:openid:params:jwt:claim:auth_req_id"];
+    if (typeof boundId !== "string" || !timingSafeEqual(boundId, expectedAuthReqId)) {
+      _emitAudit("id_token_authreqid_mismatch", "failure",
+        auditKey ? { authReqIdHash: sha3Hash(auditKey) } : {});
+      throw new AuthError("auth-ciba/id-token-authreqid-mismatch",
+        "ciba." + op + ": id_token urn:openid:params:jwt:claim:auth_req_id does not " +
+        "match the expected auth_req_id (cross-user token-substitution defense)");
+    }
+    return verified;
+  }
+
   async function pollToken(popts) {
     popts = popts || {};
     if (typeof popts.authReqId !== "string" || popts.authReqId.length === 0) {
@@ -514,6 +557,12 @@ function create(opts) {
     }
     // Token issued — clear interval tracking for this authReqId.
     _intervalState.delete(popts.authReqId);
+    // Verify the ID token (OIDC Core §3.1.3.7) via the composed inner OAuth
+    // client — it applies the create()-level issuer / clientId / JWKS /
+    // accepted-algorithms and enforces signature + iss/aud/exp. Returning an
+    // unverified id_token let a forged token's sub/acr/amr be trusted.
+    var pollClaims = await _verifyIdTokenIfPresent(rv.id_token,
+      "auth-ciba:" + popts.authReqId, "pollToken", popts.authReqId);
     _emitAudit("token_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + popts.authReqId),
     });
@@ -521,6 +570,7 @@ function create(opts) {
     return {
       accessToken:  rv.access_token   || null,
       idToken:      rv.id_token       || null,
+      claims:       pollClaims,
       refreshToken: rv.refresh_token  || null,
       tokenType:    rv.token_type     || null,
       scope:        rv.scope          || null,
@@ -545,17 +595,23 @@ function create(opts) {
    *   - In **push** mode the body carries the full token-response
    *     object; no follow-up call needed.
    *
+   * Async because a pushed `id_token` is verified (signature + iss/aud/exp)
+   * via the composed inner OAuth client before it is returned — the
+   * verified claims are surfaced as `claims`. A present-but-invalid
+   * id_token throws `auth-ciba/id-token-invalid` (the notification-token
+   * bearer authenticates the caller, never the token itself).
+   *
    * @opts
    *   { body?: object }   // pre-parsed body; defaults to req.body
    *
    * @example
-   *   app.post("/ciba/notify", function (req, res) {
-   *     var info = ciba.parseNotification(req, { body: req.body });
-   *     // → { authReqId, accessToken, idToken, ... }
+   *   app.post("/ciba/notify", async function (req, res) {
+   *     var info = await ciba.parseNotification(req, { body: req.body });
+   *     // → { authReqId, accessToken, idToken, claims, ... }
    *     res.statusCode = 204; res.end();
    *   });
    */
-  function parseNotification(req, popts) {
+  async function parseNotification(req, popts) {
     popts = popts || {};
     if (!req || !req.headers) {
       throw new AuthError("auth-ciba/bad-notification-req",
@@ -601,10 +657,16 @@ function create(opts) {
       throw new AuthError("auth-ciba/no-notification-body",
         "ciba.parseNotification: body required (Buffer/string parsed by middleware)");
     }
-    if (typeof body.auth_req_id !== "string") {
-      throw new AuthError("auth-ciba/no-auth-req-id-in-body",
-        "ciba.parseNotification: body missing auth_req_id");
-    }
+    validateOpts.requireNonEmptyString(body.auth_req_id,
+      "ciba.parseNotification: auth_req_id", AuthError, "auth-ciba/no-auth-req-id-in-body");
+    // Verify the pushed ID token (CIBA §10.2 / OIDC Core MUST) via the
+    // composed inner OAuth client before returning it as trusted. The
+    // notification-token bearer authenticates the CALLER, not the token; a
+    // leaked/observed notification token previously let an attacker inject
+    // arbitrary id_token claims the RP would trust on the documented
+    // "no follow-up call" push path.
+    var pushClaims = await _verifyIdTokenIfPresent(body.id_token,
+      "auth-ciba:" + body.auth_req_id, "parseNotification", body.auth_req_id);
     _emitAudit("notification_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + body.auth_req_id),
       mode:          deliveryMode,
@@ -614,6 +676,7 @@ function create(opts) {
       authReqId:    body.auth_req_id,
       accessToken:  body.access_token  || null,
       idToken:      body.id_token      || null,
+      claims:       pushClaims,
       refreshToken: body.refresh_token || null,
       tokenType:    body.token_type    || null,
       scope:        body.scope         || null,

package/lib/auth/dpop.js

@@ -92,7 +92,7 @@ function thumbprint(key) {
   if (!key || typeof key !== "object" || typeof key.kty !== "string" || key.kty.length === 0) {
     throw new AuthError("auth-dpop/bad-jwk", "jwk must be an object with a kty");
   }
-  if (!DPOP_KTY[key.kty]) {
+  if (!Object.prototype.hasOwnProperty.call(DPOP_KTY, key.kty)) {
     throw new AuthError("auth-dpop/refused-kty", "jwk.kty='" + key.kty + "' is not allowed (DPoP requires asymmetric kty)");
   }
   // The RFC 7638 thumbprint itself is computed by b.jwk.
@@ -317,6 +317,15 @@ async function verify(proof, opts) {
   catch (_e) { throw new AuthError("auth-dpop/malformed", "header is not valid base64url-JSON"); }
   try { payload = safeJson.parse(_b64urlDecode(parts[1]).toString("utf8")); }
   catch (_e) { throw new AuthError("auth-dpop/malformed", "payload is not valid base64url-JSON"); }
+  // safeJson.parse accepts the literal `null` / scalars, so a header segment of
+  // base64url("null") would otherwise reach `header.typ` and throw a raw
+  // TypeError rather than the typed malformed error. Require JSON objects.
+  if (!safeJson.isJsonObject(header)) {
+    throw new AuthError("auth-dpop/malformed", "header is not a JSON object");
+  }
+  if (!safeJson.isJsonObject(payload)) {
+    throw new AuthError("auth-dpop/malformed", "payload is not a JSON object");
+  }
 
   // Header checks
   if (header.typ !== "dpop+jwt") {
@@ -348,6 +357,11 @@ async function verify(proof, opts) {
       "DPoP proof declares 'crit' header — refused");
   }
 
+  // Bind the declared alg to the embedded JWK's kty/curve before handing
+  // the self-asserted key to node:crypto — every other JWS verifier in the
+  // framework enforces this (alg-confusion family, CVE-2026-22817 class).
+  jwtExternal._assertAlgKtyMatch(header.alg, header.jwk);
+
   // Verify signature against the embedded jwk
   var key = _jwkToKeyObject(header.jwk);
   var params = _signParamsForAlg(header.alg);

package/lib/auth/fido-mds3.js

@@ -43,6 +43,7 @@ var safeJson     = require("../safe-json");
 var safeBuffer   = require("../safe-buffer");
 var lazyRequire  = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var x509Chain    = require("../x509-chain");
 var jwtExternal  = require("./jwt-external");
 var _wa          = require("../vendor/simplewebauthn-server.cjs");
 var { FidoMds3Error } = require("../framework-error");
@@ -239,7 +240,10 @@ function _validateChain(x5c, rootPems) {
     var root;
     try { root = new nodeCrypto.X509Certificate(rootPems[r]); }
     catch (_e) { continue; }
-    if (tail.checkIssued(root) && tail.verify(root.publicKey)) {
+    // issuerValidlyIssued enforces basicConstraints cA:TRUE on the root in
+    // addition to the issuance + signature linkage — a non-CA cert cannot
+    // anchor the x5c chain (basicConstraints bypass, CVE-2002-0862 class).
+    if (x509Chain.issuerValidlyIssued(root, tail)) {
       anchored = true;
       break;
     }
@@ -546,24 +550,37 @@ function lookupAaguid(blob, aaguid) {
   return null;
 }
 
-// Pull the certified-level token out of a list of status reports. The
-// most recent FIDO_CERTIFIED_L{N}[_PLUS] report wins; if none exist,
-// the authenticator is uncertified (level 0).
+// Resolve the CURRENT certified level from the status-report history. FIDO MDS3
+// status reports are chronological; the level is whatever the MOST RECENT
+// certification-status report says — a FIDO_CERTIFIED_L{N}[_PLUS], or 0 when the
+// latest such report is NOT_FIDO_CERTIFIED (a decertification). Taking the
+// highest-ever level instead let a step-up / risk policy that requires L{N}
+// accept an authenticator that was later decertified or downgraded (the
+// certifiedLevel is the policy input, so a stale max is an authenticator-
+// assurance bypass). Ordering is by effectiveDate (ISO YYYY-MM-DD, so lexical ==
+// chronological); ties and missing dates fall back to array order (append
+// order, which the spec defines as chronological).
 function _certifiedLevel(statusReports) {
   if (!Array.isArray(statusReports)) return { level: 0, plus: false };
-  var best = { level: 0, plus: false };
+  var latest = null;
+  var latestDate = null;
   for (var i = 0; i < statusReports.length; i++) {
     var sr = statusReports[i];
-    if (!sr || typeof sr.status !== "string") continue;
-    var m = CERT_LEVEL_RE.exec(sr.status);
-    if (!m) continue;
-    var level = parseInt(m[1], 10);
-    var plus = !!m[2];
-    if (level > best.level || (level === best.level && plus && !best.plus)) {
-      best = { level: level, plus: plus };
+    // Only certification-status reports move the level: a level grant, or its
+    // explicit revocation (NOT_FIDO_CERTIFIED). Other statuses (UPDATE_AVAILABLE,
+    // REVOKED, …) are handled elsewhere and must not be read as a level. The
+    // status length is bounded before the regex test below — FIDO status tokens
+    // are short enums; bounding input before any .test() is the convention.
+    if (!sr || typeof sr.status !== "string" || sr.status.length > 64) continue;
+    if (!CERT_LEVEL_RE.test(sr.status) && sr.status !== "NOT_FIDO_CERTIFIED") continue;
+    var d = typeof sr.effectiveDate === "string" ? sr.effectiveDate : "";
+    if (latest === null || d >= latestDate) {
+      latest = sr; latestDate = d;
     }
   }
-  return best;
+  if (!latest || latest.status === "NOT_FIDO_CERTIFIED") return { level: 0, plus: false };
+  var m = CERT_LEVEL_RE.exec(latest.status);
+  return { level: parseInt(m[1], 10), plus: !!m[2] };
 }
 
 /**

package/lib/auth/jwt.js

@@ -117,7 +117,7 @@ function _toKeyObject(pemOrKey, kind) {
 }
 
 function _resolveAlgorithm(alg) {
-  if (typeof alg !== "string" || !ALGORITHM_TO_NODE[alg]) {
+  if (typeof alg !== "string" || !Object.prototype.hasOwnProperty.call(ALGORITHM_TO_NODE, alg)) {
     throw new AuthError("auth-jwt/unsupported-algorithm",
       "algorithm must be one of " + SUPPORTED_ALGORITHMS.join(", ") + " (got: " + alg + ")");
   }
@@ -193,6 +193,16 @@ function decode(token) {
   catch (_e) { throw new AuthError("auth-jwt/malformed", "header is not valid base64url-JSON"); }
   try { payload = safeJson.parse(_b64urlDecode(parts[1])); }
   catch (_e) { throw new AuthError("auth-jwt/malformed", "payload is not valid base64url-JSON"); }
+  // The JOSE header and the claims set MUST each be a JSON object. safeJson.parse
+  // accepts the literal `null` (a valid JSON document) and scalars/arrays, so a
+  // header segment of base64url("null") would otherwise survive to a `.crit` /
+  // `.kid` dereference and throw a raw TypeError instead of a typed AuthError.
+  if (!safeJson.isJsonObject(header)) {
+    throw new AuthError("auth-jwt/malformed", "header is not a JSON object");
+  }
+  if (!safeJson.isJsonObject(payload)) {
+    throw new AuthError("auth-jwt/malformed", "payload is not a JSON object");
+  }
   var signature;
   try { signature = _b64urlDecode(parts[2]); }
   catch (_e) { throw new AuthError("auth-jwt/malformed", "signature is not valid base64url"); }
@@ -222,7 +232,7 @@ async function verify(token, opts) {
   // Validate the allowlist itself — typoed entries should surface here,
   // not as silent "every token rejected."
   for (var i = 0; i < allowed.length; i++) {
-    if (!ALGORITHM_TO_NODE[allowed[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(ALGORITHM_TO_NODE, allowed[i])) {
       throw new AuthError("auth-jwt/unsupported-algorithm",
         "opts.algorithms[" + i + "] = '" + allowed[i] + "' is not in the supported list (" +
         SUPPORTED_ALGORITHMS.join(", ") + ")");
@@ -351,10 +361,16 @@ async function verify(token, opts) {
       "token not yet valid: nbf=" + p.nbf + " (now=" + nowSec + ", tolerance=" + tol + "s)");
   }
 
-  // String-claim assertions
-  if (opts.issuer !== undefined && !_matchClaim(p.iss, opts.issuer, "iss")) {
+  // String-claim assertions. `iss` is StringOrURI (RFC 7519 §4.1.1) — a single
+  // value, not a list: reject a non-string iss before matching. Routing it
+  // through the aud-style any-of _matchClaim let an attacker-influenced
+  // multi-issuer array (iss:["evil","trusted"]) satisfy a single-issuer
+  // expectation (CVE-2025-30144 / fast-jwt iss-array class) — the same defense
+  // jwtExternal.verifyExternal and oauth.verifyIdToken already apply.
+  if (opts.issuer !== undefined &&
+      (typeof p.iss !== "string" || !_matchClaim(p.iss, opts.issuer, "iss"))) {
     throw new AuthError("auth-jwt/iss-mismatch",
-      "iss='" + p.iss + "' does not match expected " + JSON.stringify(opts.issuer));
+      "iss=" + JSON.stringify(p.iss) + " does not match expected " + JSON.stringify(opts.issuer));
   }
   if (opts.audience !== undefined && !_matchClaim(p.aud, opts.audience, "aud")) {
     throw new AuthError("auth-jwt/aud-mismatch",

package/lib/auth/lockout.js

@@ -80,6 +80,7 @@
  */
 
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -119,7 +120,7 @@ function _requireString(name, val) {
 }
 
 function _requirePositiveInt(name, val) {
-  if (typeof val !== "number" || !isFinite(val) || val < 1 || Math.floor(val) !== val) {
+  if (!numericBounds.isPositiveFiniteInt(val)) {
     throw _err("BAD_OPT", name + ": expected positive integer, got " +
                typeof val + " " + JSON.stringify(val));
   }
@@ -261,7 +262,22 @@ function create(opts) {
 
   // ---- Public surface ----
 
-  async function recordFailure(key, callOpts) {
+  // Per-key serialization of the failure counter (read→increment→write on an
+  // async store): concurrent recordFailure calls for the same key would lose
+  // updates, letting parallel failures stay under the lockout threshold. A
+  // per-key promise chain applies them sequentially in-process.
+  var _recordChains = new Map();
+  function recordFailure(key, callOpts) {
+    var prev = _recordChains.get(key) || Promise.resolve();
+    var run = prev.then(function () { return _doRecordFailure(key, callOpts); },
+                        function () { return _doRecordFailure(key, callOpts); });
+    var tail = run.then(function () {}, function () {});
+    _recordChains.set(key, tail);
+    tail.then(function () { if (_recordChains.get(key) === tail) _recordChains.delete(key); });
+    return run;
+  }
+
+  async function _doRecordFailure(key, callOpts) {
     _requireKey(key);
     callOpts = callOpts || {};
     var now = clock();

package/lib/auth/oauth.js

@@ -1276,9 +1276,15 @@ function create(opts) {
     // browser session could be replayed without detection. Throw
     // loudly so the operator sees the bug at config time, not at
     // first-replay-attempt time.
-    if (isOidc && eopts.nonce === undefined && eopts.skipNonceCheck !== true) {
+    // Require a NON-EMPTY STRING nonce, not merely a defined one: a falsy
+    // nonce (null / "" — e.g. a session field that was never set) would slip a
+    // strict `=== undefined` guard, and the downstream verifier only checks the
+    // nonce when vopts.nonce is truthy, so the ID-token nonce check would be
+    // silently skipped and a token captured from another session replayed.
+    if (isOidc && eopts.skipNonceCheck !== true &&
+        (typeof eopts.nonce !== "string" || eopts.nonce.length === 0)) {
       throw new OAuthError("auth-oauth/no-nonce",
-        "exchangeCode: nonce is required on OIDC flows. Pass the " +
+        "exchangeCode: a non-empty nonce is required on OIDC flows. Pass the " +
         "value returned from authorizationUrl() through to exchangeCode " +
         "({ code, state, verifier, nonce }). Operators with a deliberate " +
         "no-nonce flow must pass `skipNonceCheck: true` (audited reason).");

package/lib/auth/passkey.js

@@ -385,7 +385,7 @@ function _largeBlobExt(args) {
   var SUPPORT = { preferred: 1, required: 1 };
   var modes = 0;
   if (args.support !== undefined) {
-    if (!SUPPORT[args.support]) {
+    if (!Object.prototype.hasOwnProperty.call(SUPPORT, args.support)) {
       throw new AuthError("auth-passkey/bad-largeblob-support",
         "extensions.largeBlob support must be 'preferred' or 'required'");
     }