@blamejs/core 0.15.14 → 0.15.16

package/lib/mail-dkim.js

@@ -167,13 +167,24 @@ function _parseHeaders(rawHeaders) {
 
 // ---- Hashing + signing ----
 
-function _bodyHashB64(body, algorithm, canonBody) {
+function _bodyHashB64(body, algorithm, canonBody, lcap) {
   var canonicalized = canonBody === "simple"
     ? _canonBodySimple(body)
     : _canonBodyRelaxed(body);
   var hashName = "sha256";  // both rsa-sha256 and ed25519-sha256 hash with sha256
-  return nodeCrypto.createHash(hashName)
-    .update(canonicalized).digest("base64");
+  var hash = nodeCrypto.createHash(hashName);
+  // RFC 6376 §3.4.5 — the l= body-length count is octets of the body AFTER
+  // canonicalization. Canonicalize first, then truncate the canonicalized
+  // octet stream to lcap (slicing the raw body before canonicalizing diverges
+  // whenever relaxed canon changes the byte count within the first lcap
+  // octets — WSP-run collapse, trailing-WSP strip, CRLF normalization).
+  if (typeof lcap === "number" && isFinite(lcap) && lcap >= 0) {
+    var buf = Buffer.from(canonicalized, "utf8");
+    hash.update(lcap < buf.length ? buf.subarray(0, lcap) : buf);
+  } else {
+    hash.update(canonicalized);
+  }
+  return hash.digest("base64");
 }
 
 function _signString(strToSign, privateKey, algorithm) {
@@ -471,6 +482,36 @@ function _parseDkimTagList(value) {
   return tags;
 }
 
+// RFC 6376 §3.5 — x= / t= / l= are unsigned decimal integers ("1*DIGIT").
+// parseInt() is too lenient here ("12abc" → 12, "0x10" → 0, " 12" → 12),
+// so a present-but-malformed value must not be coerced into a finite
+// number that then passes the downstream check. Returns the parsed integer,
+// or null when the value is not a well-formed unsigned integer — the caller
+// fails CLOSED on null. `maxDigits` bounds the digit count (a ReDoS-free
+// length cap; x=/t= are NumericDate, bounded to 12 digits).
+function _parseDkimUnsignedInt(raw, maxDigits) {
+  if (typeof raw !== "string") return null;
+  var len = raw.length;
+  // "1*DIGIT": non-empty, ASCII 0-9 only, length-capped. A char-code scan
+  // (no regex) keeps this linear and avoids a dynamic RegExp / a shared
+  // digit-pattern literal — maxDigits bounds x=/t=/l= to their NumericDate
+  // / octet-count headroom.
+  if (len === 0 || (maxDigits && len > maxDigits)) return null;
+  for (var i = 0; i < len; i++) {
+    var c = raw.charCodeAt(i);
+    if (c < 0x30 || c > 0x39) return null;   // not an ASCII digit
+  }
+  var n = parseInt(raw, 10);
+  if (!isFinite(n)) return null;
+  return n;
+}
+
+// x= / t= are NumericDate (seconds-since-epoch); 12 digits is ample headroom
+// past any realistic epoch and keeps the parse bounded.
+function _parseDkimNumericDate(raw) {
+  return _parseDkimUnsignedInt(raw, 12);
+}
+
 function _selectorTxtToKeyTags(txtRecords) {
   // DKIM key record is a TXT record at <selector>._domainkey.<domain>.
   // Format: "v=DKIM1; k=rsa; p=<base64>" (chunks may be split across
@@ -674,15 +715,25 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
 
   var split = _splitHeadersBody(rfc822);
   var body = split.body;
+  var lcap;
   if (sigTags.l !== undefined) {
     // The framework refuses l= at SIGN-time per the M3AAWG / Gmail /
     // Microsoft 365 guidance (v0.7.18). On VERIFY, an `l=` tag on an
     // inbound signature signals append-after-signature exposure —
     // operators decide acceptance. Honor the cap for the body hash so
     // the signature still validates against legitimate senders that
-    // use l=, but flag in the result.
-    var lcap = parseInt(sigTags.l, 10);
-    if (isFinite(lcap) && lcap >= 0) body = body.slice(0, lcap);
+    // use l=, but flag in the result. The cap is octets of the
+    // CANONICALIZED body (RFC 6376 §3.4.5), applied inside _bodyHashB64.
+    // l= is an unsigned decimal integer ("1*DIGIT" per §3.5); a
+    // present-but-unparseable value must FAIL CLOSED rather than fall
+    // through to lcap=undefined (hashing the whole body silently masks the
+    // malformed tag instead of refusing it).
+    var parsedL = _parseDkimUnsignedInt(sigTags.l, 18);
+    if (parsedL === null) {
+      return { result: "permerror",
+               errors: ["DKIM-Signature l= present but unparseable (RFC 6376 §3.5 — unsigned integer required)"] };
+    }
+    lcap = parsedL;
   }
 
   // 1. Body-hash check.
@@ -690,7 +741,7 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   if (typeof expectedBh !== "string") {
     return { result: "permerror", errors: ["DKIM-Signature missing bh="] };
   }
-  var actualBh = _bodyHashB64(body, algorithm, canonBody);
+  var actualBh = _bodyHashB64(body, algorithm, canonBody, lcap);
   if (actualBh !== expectedBh) {
     return { result: "fail", errors: ["body hash mismatch"] };
   }
@@ -909,34 +960,49 @@ async function verify(rfc822, opts) {
     // attack). Both are in seconds-since-epoch per ABNF.
     var nowSec = Math.floor(Date.now() / C.TIME.seconds(1));
     var clockSkewSec = Math.floor(clockSkewMs / C.TIME.seconds(1));
+    // x= / t= are NumericDate (digits-only seconds-since-epoch per the
+    // §3.5 ABNF). A present-but-unparseable value must FAIL CLOSED — a NaN
+    // result silently skipping the expiry / future-date / ordering checks
+    // would let verification proceed to result:"pass" with NO expiry
+    // enforced (mirrors the SAML Conditions present-but-unparseable fix).
+    var xSec = null;
     if (sigTags.x !== undefined) {
-      var expSec = parseInt(sigTags.x, 10);
-      if (isFinite(expSec) && expSec + clockSkewSec < nowSec) {
+      xSec = _parseDkimNumericDate(sigTags.x);
+      if (xSec === null) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature x= present but unparseable (RFC 6376 §3.5 — NumericDate required)"] });
+        continue;
+      }
+      if (xSec + clockSkewSec < nowSec) {
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
-          errors: ["DKIM-Signature x=" + expSec + " has expired (RFC 6376 §3.5)"] });
+          errors: ["DKIM-Signature x=" + xSec + " has expired (RFC 6376 §3.5)"] });
         continue;
       }
     }
     if (sigTags.t !== undefined) {
-      var tSec = parseInt(sigTags.t, 10);
+      var tSec = _parseDkimNumericDate(sigTags.t);
+      if (tSec === null) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature t= present but unparseable (RFC 6376 §3.5 — NumericDate required)"] });
+        continue;
+      }
       // Allow up to 24h future-skew; beyond that, refuse — neither
       // operator clock drift nor delivery latency explains a future-
       // dated signing time of more than a day.
-      if (isFinite(tSec) && tSec - (24 * 60 * 60) > nowSec) {                                  // allow:raw-time-literal — 24h future-date sanity ceiling
+      if (tSec - (24 * 60 * 60) > nowSec) {                                                    // allow:raw-time-literal — 24h future-date sanity ceiling
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
           errors: ["DKIM-Signature t=" + tSec + " is more than 24h in the future (RFC 6376 §3.5 sanity)"] });
         continue;
       }
-      if (sigTags.x !== undefined) {
-        var xSec = parseInt(sigTags.x, 10);
-        if (isFinite(xSec) && isFinite(tSec) && xSec < tSec) {
-          results.push({ d: d || null, s: s || null, alg: alg || null,
-            result: "permerror",
-            errors: ["DKIM-Signature x= must be after t= (RFC 6376 §3.5)"] });
-          continue;
-        }
+      if (xSec !== null && xSec < tSec) {
+        results.push({ d: d || null, s: s || null, alg: alg || null,
+          result: "permerror",
+          errors: ["DKIM-Signature x= must be after t= (RFC 6376 §3.5)"] });
+        continue;
       }
     }
     if (!d || !s) {

package/lib/mail.js

@@ -825,6 +825,16 @@ function smtpTransport(opts) {
   _refuseCtlBytes("host",       opts.host);
   _refuseCtlBytes("servername", opts.servername);
   var timeoutMs = opts.timeoutMs || C.TIME.seconds(15);
+  // Absolute transaction deadline — distinct from the per-socket IDLE
+  // timeout above. A slow-trickle MX that emits one byte just inside
+  // every idle window resets socket.setTimeout forever and never
+  // completes; this wall-clock bound fails the whole send regardless of
+  // trickle. Defaults well above timeoutMs so a normal multi-round-trip
+  // SMTP conversation (greeting → EHLO → STARTTLS → AUTH → MAIL/RCPT →
+  // DATA/BDAT) never trips it.
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxTransactionMs,
+    "smtp transport: opts.maxTransactionMs", MailError, "mail/smtp-misconfigured");
+  var maxTransactionMs = opts.maxTransactionMs || C.TIME.minutes(5);
   var tlsOpts = {
     rejectUnauthorized: rejectUnauthorized,
     minVersion: opts.minTlsVersion || "TLSv1.3",
@@ -875,6 +885,7 @@ function smtpTransport(opts) {
     useImplicitTLS:  useImplicitTLS,
     ehloName:        ehloName,
     timeoutMs:       timeoutMs,
+    maxTransactionMs: maxTransactionMs,
     tlsOpts:         tlsOpts,
     servername:      servername,
     dkimSigner:      opts.dkimSigner || null,
@@ -1043,6 +1054,7 @@ function _smtpSend(message, cfg) {
     var dataWireBytes = null;             // Buffer view of dataMessage for BDAT slicing
     var useBdat = false;                  // Decided post-EHLO based on peerSupportsChunking + cfg.chunkingEnabled
     var bodyMode = "7BIT";                // "7BIT" / "8BITMIME" / "BINARYMIME"
+    var txTimer = null;                   // Absolute transaction-deadline timer (cfg.maxTransactionMs)
 
     var fromAddr = _extractAddr(message.from);
     var toList   = _toArray(message.to).map(_extractAddr);
@@ -1081,9 +1093,13 @@ function _smtpSend(message, cfg) {
       }
     }
 
+    function clearTxTimer() {
+      if (txTimer) { try { clearTimeout(txTimer); } catch (_e) { /* best-effort */ } txTimer = null; }
+    }
     function fail(reason) {
       if (settled) return;
       settled = true;
+      clearTxTimer();
       try { if (socket) socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
       reject(new MailError("mail/smtp-failed",
         "SMTP send failed: " + reason, false));
@@ -1091,6 +1107,7 @@ function _smtpSend(message, cfg) {
     function done(ok, code) {
       if (settled) return;
       settled = true;
+      clearTxTimer();
       try { socket.end(); } catch (_e) { /* socket may already be torn down */ }
       if (ok) resolve({ transport: "smtp", deliveredAt: Date.now(), code: code });
       else reject(new MailError("mail/smtp-rejected",
@@ -1149,6 +1166,16 @@ function _smtpSend(message, cfg) {
 
     function onData(data) {
       buffer += data;
+      // Bound the framing accumulator. A hostile / broken MX that
+      // streams bytes without ever sending CRLF would otherwise grow
+      // `buffer` without limit and OOM the process. SMTP responses are
+      // tiny per spec; the 256 KiB cap is generous headroom. Measure
+      // bytes (not UTF-16 code units) so multibyte trickle can't slip a
+      // larger payload past a char-length check.
+      if (safeBuffer.byteLengthOf(buffer) > MAIL_RESPONSE_MAX_BYTES) {
+        fail("response-too-large");
+        return;
+      }
       var lines = buffer.split("\r\n");
       buffer = lines.pop();
       for (var i = 0; i < lines.length; i++) {
@@ -1233,6 +1260,7 @@ function _smtpSend(message, cfg) {
         // would corrupt NUL-bearing octets in transit.
         if (requiresBinaryMime && !peerSupportsBinaryMime) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/binarymime-not-advertised",
             "message has 8-bit binary content but peer does not advertise BINARYMIME (RFC 3030 §3)",
@@ -1245,6 +1273,7 @@ function _smtpSend(message, cfg) {
         // cap"; -1 means "SIZE not advertised" (no precheck).
         if (cfg.respectPeerSize && peerSizeCap > 0 && messageWireSize > peerSizeCap) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/peer-size-exceeded",
             "message wire size " + messageWireSize + " bytes exceeds peer SIZE cap " +
@@ -1341,6 +1370,7 @@ function _smtpSend(message, cfg) {
         // the chunked-body failure mode.
         if (code !== 250) {
           settled = true;
+          clearTxTimer();
           try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           reject(new MailError("mail/bdat-chunk-rejected",
             "BDAT chunk rejected (code " + code + ", offset " + bdatOffset + "/" +
@@ -1360,6 +1390,15 @@ function _smtpSend(message, cfg) {
       }
     }
 
+    // Arm the absolute transaction deadline before opening the socket so
+    // a peer that connects but then trickles (or never responds) is
+    // bounded regardless of how it games the per-socket idle timer.
+    // unref so a pending deadline never keeps the process alive on its own.
+    txTimer = setTimeout(function () {
+      fail("transaction-timeout");
+    }, cfg.maxTransactionMs);
+    if (txTimer && typeof txTimer.unref === "function") txTimer.unref();
+
     try { connect(); }
     catch (e) { fail(e.message || String(e)); }
   });

package/lib/middleware/api-encrypt.js

@@ -1086,8 +1086,12 @@ function httpClientEncrypted(opts) {
     headers["Content-Type"] = "application/json";
 
     var passThrough = {};
-    var passable = ["allowedProtocols", "allowInternal", "idleTimeoutMs", "maxResponseBytes",
-                    "agent", "errorClass"];
+    // timeoutMs (overall wall-clock cap) and signal (caller cancellation) are
+    // forwarded alongside idleTimeoutMs: without the wall-clock cap a peer that
+    // trickles bytes within the idle window holds the encrypted call open
+    // indefinitely (the plain request path already accepts both).
+    var passable = ["allowedProtocols", "allowInternal", "timeoutMs", "idleTimeoutMs",
+                    "maxResponseBytes", "signal", "agent", "errorClass"];
     for (var i = 0; i < passable.length; i++) {
       if (reqOpts[passable[i]] !== undefined) passThrough[passable[i]] = reqOpts[passable[i]];
     }

package/lib/middleware/compose-pipeline.js

@@ -287,6 +287,28 @@ function composePipeline(entries, opts) {
         catch (finalErr) { return reject(finalErr); }
         resolve();
       }
+      // A middleware (or error handler) that ENDS THE RESPONSE without calling
+      // next has halted the chain: it handled the request itself. Settle the
+      // outer promise so the awaiting router is released — a never-settled
+      // promise pins its req/res closure forever — but do NOT call finalNext:
+      // the router's next-flag stays false, so it won't run the route handler
+      // on top of an already-sent response.
+      function _resolveOnce() {
+        if (finished) return;
+        finished = true;
+        resolve();
+      }
+      // Settle when the response actually finishes. This is response-driven,
+      // not return-driven: a callback-style middleware that calls next() LATER
+      // (from a timer, stream, or legacy callback) returns before next() runs,
+      // so we must NOT treat a bare return as a halt — only an ended response.
+      // The synchronous _responseEnded() check below covers a middleware that
+      // ended the response inline (and a mock res without an event emitter);
+      // this listener covers one that ends it from a deferred callback.
+      if (res && typeof res.once === "function") {
+        res.once("finish", _resolveOnce);
+        res.once("close", _resolveOnce);
+      }
       async function dispatch(err) {
         if (finished) return;
         if (idx >= resolved.length) return _finishOnce(err);
@@ -313,14 +335,19 @@ function composePipeline(entries, opts) {
         }
         try {
           if (err) {
-            // Error handler: (err, req, res, next)
+            // Error handler: (err, req, res, next). Express convention — a
+            // 4-arg handler that returns without calling next has HANDLED the
+            // error, so the chain ends cleanly; settle (without finalNext).
             await entry.mw(err, req, res, _next);
-            if (!advanced) _finishOnce();
+            if (!advanced) _resolveOnce();
           } else {
-            // Regular middleware: (req, res, next)
+            // Regular middleware: (req, res, next). Settle only if it ENDED the
+            // response (a halt). A bare return without next is NOT treated as a
+            // halt — it may be a callback-style middleware that calls next()
+            // later (timer/stream); the finish/close listener covers a deferred
+            // response end, and a deferred next() continues the chain.
             await entry.mw(req, res, _next);
-            // 3-arg middleware that doesn't call next — chain halts.
-            // The middleware presumably wrote the response itself.
+            if (!advanced && _responseEnded(res)) _resolveOnce();
           }
         } catch (syncErr) {
           // Synchronous throw OR rejected promise — route through
@@ -334,6 +361,13 @@ function composePipeline(entries, opts) {
   };
 }
 
+// True once the response has been committed/ended — the reliable "this
+// middleware handled the request" signal (vs. the function merely returning,
+// which a callback-style middleware does before its deferred next()).
+function _responseEnded(res) {
+  return !!(res && (res.writableEnded || res.finished || res.headersSent));
+}
+
 composePipeline.CANONICAL_POSITIONS = CANONICAL_POSITIONS;
 composePipeline.ComposePipelineError = ComposePipelineError;
 

package/lib/network-dns-resolver.js

@@ -112,6 +112,7 @@ var networkDns         = require("./network-dns");
 var safeDns            = require("./safe-dns");
 var safeUrl            = require("./safe-url");
 var safeBuffer         = require("./safe-buffer");
+var safeAsync          = require("./safe-async");
 var lazyRequire        = require("./lazy-require");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
@@ -126,6 +127,14 @@ var DEFAULT_MAX_TTL_MS    = C.TIME.hours(24);
 var DEFAULT_MIN_TTL_MS    = C.TIME.seconds(60);
 var DEFAULT_STALE_WINDOW  = C.TIME.hours(6);
 var DEFAULT_PROFILE       = "strict";
+// CWE-400. Per-query wall-clock deadline on the upstream transport
+// lookup. A non-responsive / slow / stalling DoH endpoint (or a
+// transport that sends headers then never ends the body) must not hold
+// the await pending forever — every query() and every followCnames hop
+// is bounded by this, and the default _wireLookup additionally tears
+// the socket down (req.setTimeout) so the fd is released, not just the
+// promise rejected. 10s matches a generous DoH round-trip ceiling.
+var DEFAULT_TIMEOUT_MS    = C.TIME.seconds(10);
 // CWE-400/770. Bound the cache so a hostile peer
 // that can drive query-name selection (e.g. inbound SMTP forwarding
 // DKIM `s=` / `d=` tag-controlled lookups) cannot inflate the Map to
@@ -168,6 +177,7 @@ var QTYPE_BY_NAME = Object.freeze({
  *   maxTtlMs:    number,           // cap any TTL from upstream; default 24h
  *   minTtlMs:    number,           // floor short-TTL records; default 60s
  *   serveStale:  number | false,   // ms to retain expired entries; default 6h
+ *   timeoutMs:   number,           // per-query upstream deadline; default 10s
  *   transport:   { lookup(name, qtype) → Promise<Buffer> },   // operator override
  *   audit:       b.audit namespace,
  *
@@ -187,7 +197,12 @@ function create(opts) {
   var minTtlMs    = typeof opts.minTtlMs === "number" ? opts.minTtlMs : DEFAULT_MIN_TTL_MS;
   var serveStale  = opts.serveStale === false ? 0 :
                     typeof opts.serveStale === "number" ? opts.serveStale : DEFAULT_STALE_WINDOW;
-  var transport   = opts.transport || _defaultTransport();
+  var timeoutMs   = typeof opts.timeoutMs === "number" ? opts.timeoutMs : DEFAULT_TIMEOUT_MS;
+  if (!isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new ResolverError("resolver/bad-input",
+      "create: timeoutMs must be a positive finite number");
+  }
+  var transport   = opts.transport || _defaultTransport(timeoutMs);
   // Audit goes to the operator-supplied sink (opts.audit) when present, else the
   // framework chain — b.audit.namespaced no-ops if the sink has no safeEmit.
   var _baseAudit  = audit().namespaced("network.dns.resolver", { sink: opts.audit });
@@ -276,10 +291,18 @@ function create(opts) {
       return _result(hit.parsed, hit.ttl, true, false, hit.validated);
     }
 
-    // Cache miss / expired — fetch from upstream.
+    // Cache miss / expired — fetch from upstream, bounded by the
+    // per-query wall-clock deadline. withTimeout rejects the await so a
+    // non-responsive / stalling endpoint can't hold the request pending
+    // forever; the default _wireLookup also tears the socket down on its
+    // own req.setTimeout so the underlying fd is released.
     var wireResponse;
     try {
-      wireResponse = await transport.lookup(name, qtype);
+      wireResponse = await safeAsync.withTimeout(
+        Promise.resolve(transport.lookup(name, qtype)),
+        timeoutMs,
+        { name: "dns-resolver:" + name + "/" + qtype }
+      );
     } catch (e) {
       // Upstream failure — serve stale if we have it within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
@@ -425,13 +448,13 @@ function create(opts) {
   };
 }
 
-function _defaultTransport() {
+function _defaultTransport(timeoutMs) {
   // Default transport — compose b.network.dns.useDnsOverHttps()'s
   // existing DoH path. We use the wire-format DoH endpoint directly
   // so the response arrives as raw bytes for safeDns parsing.
   return {
     lookup: function (name, qtype) {
-      return _wireLookup(name, qtype);
+      return _wireLookup(name, qtype, timeoutMs);
     },
   };
 }
@@ -440,7 +463,9 @@ function _defaultTransport() {
 // existing DoH path. Returns the raw response bytes for safeDns to
 // parse. Distinct from the existing network-dns DoH path which returns
 // already-decoded address strings — we need the raw bytes here.
-async function _wireLookup(name, qtype) {
+async function _wireLookup(name, qtype, timeoutMs) {
+  var ms = typeof timeoutMs === "number" && isFinite(timeoutMs) && timeoutMs > 0
+    ? timeoutMs : DEFAULT_TIMEOUT_MS;
   var url = networkDns._getDohUrlForTest ? networkDns._getDohUrlForTest() : "https://cloudflare-dns.com/dns-query";
   // Encode a wire-format query for the target qtype.
   var qbuf = _encodeWireQuery(name, qtype);
@@ -448,6 +473,18 @@ async function _wireLookup(name, qtype) {
   var getUrl = url + (url.indexOf("?") === -1 ? "?" : "&") + "dns=" + b64;
   var u = safeUrl.parse(getUrl, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS });
   return new Promise(function (resolve, reject) {
+    var settled = false;
+    function _fail(err) {
+      if (settled) return;
+      settled = true;
+      try { req.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+      reject(err);
+    }
+    function _done(buf) {
+      if (settled) return;
+      settled = true;
+      resolve(buf);
+    }
     // Raw DoH wire-format request — bypasses b.httpClient envelope
     // because we need the raw binary response bytes for safeDns to
     // parse (httpClient assumes JSON/text shapes).
@@ -470,18 +507,31 @@ async function _wireLookup(name, qtype) {
       res.on("data", function (c) { if (!pushFailed) { try { collector.push(c); } catch (e) { pushFailed = e; } } });
       res.on("end", function () {
         try {
-          if (pushFailed) { reject(pushFailed); return; }
+          if (pushFailed) { _fail(pushFailed); return; }
           if (res.statusCode !== 200) {                                                                  // HTTP 200 OK
-            reject(new ResolverError("resolver/upstream-http",
+            _fail(new ResolverError("resolver/upstream-http",
               "DoH HTTP " + res.statusCode + " for " + name));
             return;
           }
-          resolve(collector.result());
-        } catch (e) { reject(e); }
+          _done(collector.result());
+        } catch (e) { _fail(e); }
       });
     });
+    // Wall-clock / idle deadline — a DoH endpoint that accepts the
+    // connection, sends 200 headers, then never ends the body would
+    // otherwise hold the socket (and its fd) open indefinitely. setTimeout
+    // arms on socket inactivity; on fire we tear the socket down AND reject
+    // so neither the promise nor the fd leaks (CWE-400 slowloris-style).
+    req.setTimeout(ms, function () {
+      _fail(new ResolverError("resolver/upstream-timeout",
+        "DoH request to " + u.hostname + " for " + name + " exceeded " + ms + "ms"));
+    });
+    req.on("timeout", function () {
+      _fail(new ResolverError("resolver/upstream-timeout",
+        "DoH request to " + u.hostname + " for " + name + " exceeded " + ms + "ms"));
+    });
     req.on("error", function (e) {
-      reject(new ResolverError("resolver/upstream-failed",
+      _fail(new ResolverError("resolver/upstream-failed",
         "DoH request failed: " + e.message));
     });
     req.end();

package/lib/network-dns.js

@@ -28,11 +28,18 @@ var HEX_RADIX        = C.BYTES.bytes(16);   // parseInt / toString radix-16
 var observability = lazyRequire(function () { return require("./observability"); });
 var safeEnv = require("./parsers/safe-env");
 
+// Default wall-clock deadline for every lookup (resolve / DoH / DoT /
+// system). Without a non-zero default a header-then-stall or
+// slow-trickle upstream hangs the request forever (CWE-400). 10s
+// matches the resolver's default. Operators override via
+// setLookupTimeoutMs(); 0 disables the deadline (operator opt-out).
+var DEFAULT_LOOKUP_TIMEOUT_MS = C.TIME.seconds(10);
+
 var STATE = {
   servers:        null,
   resultOrder:    null,
   family:         0,
-  lookupTimeoutMs: 0,
+  lookupTimeoutMs: DEFAULT_LOOKUP_TIMEOUT_MS,
   cacheTtlMs:     0,
   cacheNegativeTtlMs: 0,
   doh:            null,
@@ -285,6 +292,19 @@ function _withTimeout(promise, ms, host) {
   });
 }
 
+// Arm a wall-clock deadline on a raw https.request so a stalled upstream
+// (headers-then-stall, slow-trickle body) tears the socket down instead
+// of leaking the fd until the process exits. The promise-level
+// _withTimeout rejects the caller, but only this destroys the underlying
+// connection. No-op when the operator has disabled the deadline (ms<=0).
+function _armRequestTimeout(req, ms, host, reject) {
+  if (ms <= 0) return;
+  req.setTimeout(ms, function () {
+    try { req.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+    reject(new DnsError("dns/lookup-timeout", "dns lookup of '" + host + "' exceeded " + ms + "ms"));
+  });
+}
+
 function _encodeDnsQuery(host, qtype) {
   var parts = host.split(".").filter(Boolean);
   var nameLen = 1;
@@ -450,6 +470,7 @@ async function _dohLookup(host, family) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -511,6 +532,7 @@ async function _dohLookupSecure(host, family) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -591,6 +613,17 @@ function _dotConnect() {
   // when idle — _dotLookup toggles this around its query. Calling
   // unref() unconditionally here let node exit during a normal lookup
   // when no other I/O kept the event loop alive.
+  //
+  // Wall-clock teardown: a stalled handshake or trickle-response upstream
+  // would otherwise leak the socket until the process exits (CWE-400).
+  // On inactivity past the deadline destroy the socket — the pool's
+  // error/close handlers evict it and the next lookup rebuilds. No-op
+  // when the operator has disabled the deadline (lookupTimeoutMs<=0).
+  if (STATE.lookupTimeoutMs > 0) {
+    sock.setTimeout(STATE.lookupTimeoutMs, function () {
+      try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+    });
+  }
   return sock;
 }
 
@@ -865,6 +898,7 @@ async function _dohRawQuery(host, qtype) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -979,6 +1013,17 @@ async function _systemRawQuery(host, qtype) {
       try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
       if (err) reject(err); else resolve(val);
     }
+    // Wall-clock teardown: a server that accepts the TCP connection but
+    // never replies (or trickles the length-prefix) would otherwise hang
+    // the query forever (CWE-400). On inactivity past the deadline
+    // settle()'s destroy() tears the socket down. No-op when the operator
+    // has disabled the deadline (lookupTimeoutMs<=0).
+    if (STATE.lookupTimeoutMs > 0) {
+      sock.setTimeout(STATE.lookupTimeoutMs, function () {
+        settle(new DnsError("dns/lookup-timeout",
+          "system DNS TCP query of '" + host + "' exceeded " + STATE.lookupTimeoutMs + "ms"));
+      });
+    }
     sock.on("connect", function () {
       var lenBuf = Buffer.alloc(2);
       lenBuf.writeUInt16BE(enc.buf.length, 0);
@@ -1684,7 +1729,7 @@ function nodeLookup(host, options, callback) {
 function _stateForTest() { return STATE; }
 function _resetForTest() {
   STATE.servers = null; STATE.resultOrder = null; STATE.family = 0;
-  STATE.lookupTimeoutMs = 0; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
+  STATE.lookupTimeoutMs = DEFAULT_LOOKUP_TIMEOUT_MS; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
   STATE.doh = null; STATE.dot = null; STATE.systemResolver = false;
   _designatedResolvers = null;
   _clearCache();

package/lib/network-nts.js

@@ -7,12 +7,20 @@ var nodeCrypto = require("node:crypto");
 var C = require("./constants");
 var { timingSafeEqual } = require("./crypto");
 var validateOpts = require("./validate-opts");
+var safeBuffer = require("./safe-buffer");
 var { defineClass } = require("./framework-error");
 
 var NtsError = defineClass("NtsError", { alwaysPermanent: false });
 
 var NTS_KE_DEFAULT_PORT = 4460;
 var NTPV4_DEFAULT_PORT  = 123;
+// Upper bound on accumulated NTS-KE handshake bytes before a REC_END
+// record terminates the exchange. A conformant NTS-KE response is a few
+// hundred bytes (RFC 8915 §4); 64 KiB is generous. Without this ceiling
+// a malicious or buggy server that streams non-END records fast enough
+// OOMs the process before the wall-clock timer fires (it bounds time,
+// not memory). Mirrors the ws-client handshake header cap.
+var NTS_KE_HANDSHAKE_MAX_BYTES = C.BYTES.kib(64);
 // RFC 5905 §6 — seconds between 1900-01-01T00:00Z (NTP epoch) and
 // 1970-01-01T00:00Z (Unix epoch). Protocol-fixed (not a tunable).
 var NTP_TO_UNIX_OFFSET_SECONDS = 2208988800;
@@ -284,6 +292,14 @@ function performKeHandshake(opts) {
     var warnings = [];
     sock.on("data", function (chunk) {
       got = Buffer.concat([got, chunk]);
+      if (safeBuffer.byteLengthOf(got) > NTS_KE_HANDSHAKE_MAX_BYTES) {
+        clearTimeout(timer);
+        try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+        done(new NtsError("nts/ke-too-large",
+          "NTS-KE handshake exceeded " + NTS_KE_HANDSHAKE_MAX_BYTES +
+          " bytes before a REC_END record"));
+        return;
+      }
       try {
         var records = _decodeRecords(got);
         var endRec = records.find(function (r) { return r.type === REC_END; });