@blamejs/core 0.15.37 → 0.15.39

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.39 (2026-06-27) — **Nine more places that matched an operator-supplied regex against request data — User-Agent, Origin, request path, form fields, SMTP HELO, release-asset names — now screen the pattern for catastrophic backtracking (ReDoS) before use, and a new b.guardRegex.assertSafe helper makes that screening one call.** The previous release screened feature-flag and MCP regex patterns for ReDoS but did not sweep every place the framework matches an operator-supplied regex against attacker-controlled input. Nine more were found and fixed: the bot guard (User-Agent), CORS (Origin), the HTTP span middleware and the shared request skip-matcher used by CSRF / fetch-metadata / rate-limit / access-lock / age-gate and the request logger (request path), static serving (hashed-asset path pattern), form field validation (submitted field value), SMTP HELO generic-rDNS patterns (HELO name), and the self-updater's asset/signature patterns (names from a remote release feed). Each accepted an operator RegExp with only a type check and ran it on every matching request, so an accidentally catastrophic pattern such as (a+)+$ or ((a)+)+$ could pin a CPU on a crafted input — a length cap does not bound backtracking. Every one now screens the pattern through b.guardRegex at configuration time. A new b.guardRegex.assertSafe(input, label?, ErrorClass?, code?) primitive performs that screen in one call (accepting a RegExp or a pattern string), which operators can also use on their own patterns. **Added:** *b.guardRegex.assertSafe — screen a RegExp or pattern string for ReDoS in one call* — b.guardRegex.assertSafe(input, label?, ErrorClass?, code?, opts?) screens an already-compiled RegExp (its source) or a raw pattern string for the catastrophic-backtracking classes — nested, alternation-with, and lookaround quantifiers — throwing the supplied framework-error class (or the underlying GuardRegexError) on a hostile pattern and returning the input on success. It allows large or open-ended bounded repeats (`{8,}`, `{n,m}`): a single counted repeat matches in linear time and legitimate patterns (including the framework's own defaults) use them. It is the config-time guard used by the request-lifecycle fixes above, and operators can apply it to their own patterns before matching them against untrusted input. **Security:** *Operator regex patterns matched against request data are screened for ReDoS framework-wide* — An operator-supplied RegExp matched against attacker-controllable input is a denial-of-service surface if it has a catastrophic-backtracking shape: the input triggers exponential work in the regex engine. Nine sites accepted such patterns with only an `instanceof RegExp` type check and executed them per request — bot-guard against the User-Agent, CORS against the Origin header, the HTTP span middleware and the shared skip-path matcher (CSRF / fetch-metadata / rate-limit / access-lock / age-gate / request-log) against the request path, static serving against the request path, form validation against the submitted field value, SMTP HELO checks against the HELO name, and the self-updater against asset names from a remote release feed. Each now routes the pattern through b.guardRegex at configuration time, so a catastrophic shape is refused up front instead of being weaponized by a crafted request. A length bound on the input is not a defense: a nested-quantifier pattern backtracks catastrophically at a few dozen characters. **Detectors:** *Build guard: an operator regex matched against request input must be ReDoS-screened* — A codebase guard now fails the build if a primitive accepts an operator-supplied RegExp and executes it against request input without screening the pattern through b.guardRegex.assertSafe — so the catastrophic-backtracking class fixed in this release cannot be reintroduced at a new site (the trusted-input cases — local filesystem paths, operator config keys, operator-owned schemas — are explicitly allowlisted). · *Build guard: process.moduleLoadList filters must match the 'NativeModule X' naming* — A guard now fails the build if a test filters process.moduleLoadList by the 'node:X' name only. Node 20+ records a loaded builtin as 'NativeModule X', so a 'node:'-only filter in an edge-runtime no-eager-load test would rot green and miss a reintroduced top-level networking require.
+
+- v0.15.38 (2026-06-27) — **Regex patterns supplied in feature-flag targeting rules and MCP tool input schemas are now screened for catastrophic-backtracking (ReDoS) shapes before compilation, so a pattern matched against request data can't pin a CPU.** Two places compiled a caller-supplied regex pattern and `.test()`'d it against request-controlled input with only a length bound as the stated defense: a feature-flag targeting condition (`op: "regex"`) matched against runtime attribute values, and an MCP tool's input-schema `pattern` matched against tool-call arguments. A length bound is not a ReDoS defense — a catastrophic-backtracking pattern such as `(a+)+$` is six characters and pins a CPU on a crafted input. Both patterns now pass through `b.guardRegex` (strict profile) before compilation, which refuses nested-quantifier, alternation-with-quantifier, and quantifier-inside-lookaround shapes. A ReDoS-shaped flag pattern is refused when the rules are validated; a ReDoS-shaped MCP schema pattern fails tool-input validation. Patterns built from the framework's own static tables, operator-owned JSON Schema patterns, the Sieve glob translator (which cannot express nested quantifiers), and the I-Regexp translator (linear by dialect) are unchanged. **Security:** *Feature-flag regex targeting conditions are screened for ReDoS before compilation* — A flag targeting rule with `op: "regex"` compiled the operator-supplied pattern and `.test()`'d it against runtime attribute values, guarded only by a 200-character length cap. Length does not bound catastrophic backtracking, so a pattern like `(a+)+$` combined with an attacker-controlled attribute value could pin a CPU during flag evaluation. The pattern is now screened through b.guardRegex (strict) when the rules are validated, and a catastrophic-backtracking shape is refused with a clear error. · *MCP tool input-schema patterns are screened for ReDoS before matching request input* — b.mcp.validateToolInput compiled a tool author's input-schema `pattern` and matched it against tool-call argument values; the 4096-character input cap does not bound backtracking (a `(a+)+$` pattern blows up at roughly forty input characters). The schema pattern is now screened through b.guardRegex (strict) before compilation, so a ReDoS-shaped pattern in a registered tool's schema fails input validation instead of letting hostile arguments hang the validator. · *b.guardRegex now catches wrapped nested-quantifier patterns* — The nested-quantifier detector matched a quantified group whose body contained a quantifier, but its inner match was paren-blind, so wrapping the inner quantifier in an extra group — `((a)+)+`, `(([a-z]+)*)*`, `((a+))+` — slipped past it while remaining catastrophic. A structural scan now tracks group nesting and refuses an unbounded-quantified group whose body itself contains an unbounded quantifier at any depth, so the wrapped forms are rejected alongside the bare `(a+)+`. Bounded repeats (`{n}`, `{n,m}`) are unaffected. This strengthens every b.guardRegex caller, including the flag-targeting and MCP screening above.
+
 - v0.15.37 (2026-06-27) — **Several numeric options that silently accepted a non-finite value — disabling a clock-skew / freshness check or a resource cap — now reject it, so an `Infinity` skew or limit can no longer turn off the protection it configures.** A number of configuration options validated a numeric value with a bare `typeof === "number" && value >= 0` check, which accepts `Infinity`. Where the value is a clock-skew tolerance or a resource cap, an `Infinity` (or `NaN`) silently disabled the very check it tunes: a CWT / OCSP-staple / ARC clock-skew of `Infinity` made the expiry, freshness, and expiration comparisons unsatisfiable (an expired token / a replayed pre-revocation "good" response / an expired ARC seal would be accepted); a WebSocket-client `maxMessageBytes` / `maxFrameBytes` / `handshakeTimeoutMs` of `Infinity` disabled the inbound-OOM and stalled-handshake defenses; and inbox / flag-cache / audit-chain size and count caps of `Infinity` admitted unbounded data. These options now route through the finite-bounds validator: a present non-finite value is refused at the entry point (or falls back to the safe default on the result-returning paths). Options where an unbounded value is a deliberate intent — reconnect "retry indefinitely", inbox "retain indefinitely" — continue to accept `Infinity`. **Security:** *A non-finite clock-skew no longer disables CWT / OCSP / ARC time checks* — b.cwt.verify, the OCSP-staple freshness check in b.network.tls, and b.mail.arc.verify each took an operator clock-skew tolerance validated as `typeof === "number" && >= 0`, which accepts `Infinity`. Because each check is of the form `now > deadline + skew`, a skew of `Infinity` made it unsatisfiable and silently turned the check off: an expired CWT verified, a stale (post-nextUpdate) OCSP "good" response — the exact reply an attacker replays after the certificate is revoked — was accepted, and an expired ARC seal passed. A present clock-skew that is not a non-negative finite integer is now refused (b.cwt.verify throws cwt/bad-clock-skew; the OCSP and ARC paths fall back to their safe default). Regression tests assert an expired token / stale staple / expired ARC seal is still rejected when the skew is `Infinity`. · *WebSocket-client inbound caps can no longer be disabled by an Infinity value* — b.wsClient.connect validated maxMessageBytes, maxFrameBytes, and handshakeTimeoutMs (and the ping/pong keepalive intervals) with a bare numeric check that accepted `Infinity`, which disabled the inbound-message and frame size limits — the defenses against a malicious server sending an unbounded message — and the handshake timeout. A present non-finite value for these is now refused at connect time. The reconnect maxAttempts still accepts `Infinity` (a deliberate "reconnect indefinitely" intent). · *Inbox, flag-cache, and audit-chain caps reject a non-finite limit* — The inbox maxPayloadBytes / messageIdMaxLen / sourceMaxLen caps, the flag-cache ttlMs / maxEntries, and the audit-chain partition fan-out cap each accepted `Infinity`, disabling the cap (unbounded stored payloads, a never-expiring or unbounded cache, unbounded fan-out). These now require a positive finite integer — refused at create time, or clamped to the bounded default on the result-returning verify path. The inbox retentionDays still accepts `Infinity` (retain indefinitely).
 
 - v0.15.36 (2026-06-27) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** The codebase-patterns guard class that allows a bare comma/semicolon split on token-only RFC header grammars was re-verified from scratch and renamed to a descriptive token, with its old name recorded as retired. Each live marked site (RRULE, RFC 9421 component identifiers, TLS-RPT rua, SCIM attribute paths) was re-read and confirmed to split a grammar with no quoted-string members. Five marker comments that suppressed nothing were removed or turned into plain explanatory comments. No runtime code, public API, or wire format changed. **Detectors:** *Bare token-only header-split suppression class re-verified, renamed, and pruned of inert markers* — Each marked bare `.split(",")` / `.split(";")` on an RFC header value was re-read and confirmed to operate on a token-only grammar (no quoted-string members, so a quote-aware splitter is unnecessary): RFC 5545 RRULE, RFC 9421 signature component identifiers, RFC 8460 TLS-RPT rua, and RFC 7644 SCIM attribute paths. The guard class was renamed to a descriptive token and its old name added to the retired-token set. Five marker comments that the detector never actually evaluated (two sat on a date-normalizing `.replace`, three in header parsers the guard intentionally does not scan) were removed or converted to plain comments. This is test-suite tooling plus source-comment text; no shipped framework behavior changed.

package/lib/flag-targeting.js

@@ -27,6 +27,8 @@
  */
 
 var validateOpts = require("./validate-opts");
+var lazyRequire = require("./lazy-require");
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
@@ -171,8 +173,14 @@ function validateRules(rules, label) {
           throw new FlagError("flag/bad-condition",
             clabel + ".value: regex pattern must be <= 200 chars (DoS defense)");
         }
+        // The compiled regex is .test()'d against runtime attribute values, so a
+        // catastrophic-backtracking (ReDoS) pattern is a DoS vector. A length
+        // bound does NOT defend ReDoS (`(a+)+$` is 6 chars); screen the pattern
+        // through b.guardRegex first — it refuses nested-quantifier / alternation-
+        // quantifier / lookaround-quantifier shapes before compilation.
+        guardRegex().assertSafe(cond.value, clabel + ".value", FlagError, "flag/bad-condition");
         try {
-          // allow:dynamic-regex — operator-supplied targeting pattern, length-bounded to 200 chars above
+          // allow:dynamic-regex — operator targeting pattern, ReDoS-screened via guardRegex.assertSafe + length-bounded to 200 chars above
           validatedCond._compiledRegex = new RegExp(cond.value);
         } catch (e) {
           throw new FlagError("flag/bad-condition",

package/lib/forms.js

@@ -34,6 +34,7 @@
  */
 var C = require("./constants");
 var { generateToken, timingSafeEqual } = require("./crypto");
+var guardRegex = require("./guard-regex");
 var safeSchema = require("./safe-schema");
 var safeUrl = require("./safe-url");
 var template = require("./template");
@@ -198,6 +199,10 @@ function _renderInput(field) {
         "'.pattern must be a pre-compiled RegExp; got " +
         (typeof field.pattern) + ". Wrap the source string with `RegExp` at config time.");
     }
+    // Screen the operator-supplied pattern for catastrophic-backtracking
+    // (ReDoS) shapes at config time so a hostile-form-spec can't stage a
+    // pathological regex against the engine.
+    guardRegex.assertSafe(field.pattern, "forms: field[" + field.name + "].pattern");
     attrs.push('pattern="' + escapeAttribute(field.pattern.source) + '"');
   }
   if (field.min !== undefined)        attrs.push('min="' + escapeAttribute(field.min) + '"');
@@ -490,6 +495,10 @@ function validate(spec, body) {
             "'.pattern must be a pre-compiled RegExp; got " +
             (typeof f.pattern) + ". Wrap the source string with `RegExp` at config time.");
         }
+        // Screen the operator-supplied pattern for catastrophic-backtracking
+        // (ReDoS) shapes before the test, so a pathological regex can't be
+        // run against the submitted value.
+        guardRegex.assertSafe(f.pattern, "forms: field[" + f.name + "].pattern");
         if (!f.pattern.test(coerced)) {
           errors[f.name] = f.errorMessages && f.errorMessages.pattern
             ? f.errorMessages.pattern

package/lib/guard-regex.js

@@ -128,19 +128,68 @@ var DEFAULTS = gateContract.strictDefaults(PROFILES);
 
 var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
 
+// Structural nested-unbounded-quantifier detector. NESTED_QUANT_RE is paren-
+// blind (its `[^()]*` can't span a nested group), so it misses WRAPPED forms
+// like `((a)+)+` / `(([a-z]+)*)*` / `((a+))+` — adding one extra group around
+// the inner quantifier bypasses the regex while the pattern stays catastrophic.
+// This linear scan tracks group nesting and flags an unbounded-quantified group
+// (`)+`, `)*`, `){n,}`) whose body itself contains an unbounded quantifier — the
+// two-nested-unbounded-quantifier ReDoS class — at any group depth. Bounded
+// repeats (`{n}`, `{n,m}`, `?`) are not unbounded, so they don't trip it (the
+// large-bound case is handled separately by maxBoundedRepeat).
+function _hasNestedQuantifier(src) {
+  var stack = [];        // open groups: each { quant } — body has an unbounded quantifier
+  var inClass = false;   // inside a [...] character class
+  var i = 0;
+  var n = src.length;
+  var UNBOUNDED_AFTER_GROUP = /^(?:[*+]\??|\{\d*,\})/;   // )+ )* )+? )*? ){n,}
+  while (i < n) {
+    var c = src.charAt(i);
+    if (c === "\\") { i += 2; continue; }                          // escaped atom — skip both chars
+    if (inClass) { if (c === "]") inClass = false; i += 1; continue; }
+    if (c === "[") { inClass = true; i += 1; continue; }
+    if (c === "(") { stack.push({ quant: false }); i += 1; continue; }
+    if (c === ")") {
+      var grp = stack.pop() || { quant: false };
+      var qm = UNBOUNDED_AFTER_GROUP.exec(src.slice(i + 1));       // allow:regex-no-length-cap — bounded slice of a maxPatternBytes-capped input
+      var closeUnbounded = qm !== null;
+      if (grp.quant && closeUnbounded) return true;               // nested unbounded quantifier → catastrophic
+      // The closing group contributes an unbounded quantifier to its PARENT's
+      // body if its own body had one, or if it is itself unbounded-quantified.
+      if (stack.length && (grp.quant || closeUnbounded)) stack[stack.length - 1].quant = true;
+      i += 1 + (qm ? qm[0].length : 0);
+      continue;
+    }
+    if (c === "*" || c === "+") {                                  // unbounded quantifier on the preceding atom
+      if (stack.length) stack[stack.length - 1].quant = true;
+      i += 1; continue;
+    }
+    if (c === "{") {
+      var open = /^\{\d*,\}/.exec(src.slice(i));                  // allow:regex-no-length-cap — bounded slice // {n,} unbounded
+      if (open) { if (stack.length) stack[stack.length - 1].quant = true; i += open[0].length; continue; }
+      var bounded = /^\{\d+(?:,\d+)?\}/.exec(src.slice(i));       // allow:regex-no-length-cap — bounded slice // {n} / {n,m} bounded
+      if (bounded) { i += bounded[0].length; continue; }
+      i += 1; continue;                                            // literal `{`
+    }
+    i += 1;
+  }
+  return false;
+}
+
 
 function _detectIssues(input, opts) {
   var pre = gateContract.detectStringInput(input, opts, { name: "regex", noun: "regex pattern", cap: { bytes: opts.maxPatternBytes, kind: "pattern-cap", snippet: "regex pattern exceeds maxPatternBytes " + opts.maxPatternBytes } });
   if (pre.done) return pre.issues;
   var issues = pre.issues;
 
-  if (opts.nestedQuantPolicy !== "allow" && NESTED_QUANT_RE.test(input)) {       // allow:regex-no-length-cap — input bounded by maxPatternBytes
+  if (opts.nestedQuantPolicy !== "allow" &&
+      (NESTED_QUANT_RE.test(input) || _hasNestedQuantifier(input))) {            // allow:regex-no-length-cap — input bounded by maxPatternBytes
     issues.push({
       kind: "nested-quantifier", severity: "critical",
       ruleId: "regex.nested-quantifier",
       snippet: "pattern contains nested-quantifier shape (e.g. " +
-               "`(a+)+`) — canonical ReDoS catastrophic-backtracking " +
-               "class (CVE-2024-21538 cross-spawn / CVE-2022-25929)",
+               "`(a+)+` / `((a)+)+`) — canonical ReDoS catastrophic-" +
+               "backtracking class (CVE-2024-21538 cross-spawn / CVE-2022-25929)",
     });
   }
 
@@ -463,6 +512,61 @@ function gate(opts) {
 // ---- adaptive integration-test fixtures (consumed by layer-5 host harness) ----
 var INTEGRATION_FIXTURES = gateContract.identifierFixtures("^[a-z]+$", "(a+)+b");
 
+/**
+ * @primitive  b.guardRegex.assertSafe
+ * @signature  b.guardRegex.assertSafe(input, label?, ErrorClass?, code?, opts?)
+ * @since      0.15.39
+ * @status     stable
+ * @related    b.guardRegex.sanitize, b.guardRegex.validate
+ *
+ * Screen an already-compiled <code>RegExp</code> (or a raw pattern string) for
+ * catastrophic-backtracking (ReDoS) shapes, throwing if the pattern is unsafe.
+ * This is the config-time guard for request-lifecycle code that matches an
+ * operator-supplied regex against attacker-controlled input (User-Agent,
+ * Origin, request path, form field, HELO) — an accidentally-catastrophic
+ * operator pattern would otherwise be a per-request DoS once a hostile input
+ * triggers the backtracking.
+ *
+ * Pass a <code>RegExp</code> instance (its <code>.source</code> is screened) or
+ * a pattern string. On a hostile shape it throws <code>ErrorClass(code, ...)</code>
+ * when an error class is supplied, otherwise the underlying
+ * <code>GuardRegexError</code>. Returns the input unchanged on success.
+ *
+ * By default it rejects the catastrophic-backtracking classes — nested,
+ * alternation-with, and lookaround quantifiers — but ALLOWS large/open bounded
+ * repeats (<code>{8,}</code>, <code>{n,m}</code>): a single counted repeat is
+ * linear, not exponential, and legitimate patterns (e.g. a hex hash of 8+
+ * digits) use them. Pass an explicit <code>opts</code> to override.
+ *
+ * @opts
+ *   profile:             string,   // guardRegex profile (default: "strict")
+ *   boundedRepeatPolicy: string,   // default: "allow" (large bounded repeats are linear)
+ *
+ * @example
+ *   b.guardRegex.assertSafe(/^[a-z]+$/);            // ok — returns the RegExp
+ *   b.guardRegex.assertSafe(/\.[a-f0-9]{8,}\./);    // ok — a single bounded repeat is linear
+ *   try { b.guardRegex.assertSafe(/((a)+)+$/); }    // throws — nested quantifier
+ *   catch (e) { e.code; }                           // → "regex/unsafe-pattern"
+ */
+function assertSafe(input, label, ErrorClass, code, opts) {
+  var source = (input instanceof RegExp) ? input.source : input;
+  try {
+    // Screen the catastrophic-backtracking classes (nested / alternation /
+    // lookaround quantifiers — held at every profile) but allow large bounded
+    // repeats: a counted repeat matches in linear time, and rejecting `{n,}`
+    // would refuse legitimate operator patterns (and the framework's own
+    // defaults, e.g. b.staticServe.DEFAULT_HASHED_PATTERN's `{8,}`).
+    _guard.sanitize(source, opts || { profile: "strict", boundedRepeatPolicy: "allow" });
+  } catch (e) {
+    if (ErrorClass) {
+      throw new ErrorClass(code || "regex/unsafe-pattern",
+        (label || "regex") + ": pattern rejected as unsafe (ReDoS shape) - " + (e && e.message));
+    }
+    throw e;
+  }
+  return input;
+}
+
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
@@ -481,3 +585,5 @@ var _guard = module.exports = gateContract.defineGuard({
   intOpts:           ["maxBytes", "maxPatternBytes", "maxBoundedRepeat", "maxConsecutiveStars"],
   gate:        gate,
 });
+
+_guard.assertSafe = assertSafe;

package/lib/mail-helo.js

@@ -105,6 +105,7 @@ var { defineClass }    = require("./framework-error");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
 var gateContract       = require("./gate-contract");
+var guardRegex         = require("./guard-regex");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
@@ -210,6 +211,19 @@ async function evaluate(ctx, opts) {
   var selfNames = (opts.selfNames || []).map(function (n) { return String(n).toLowerCase(); });
   var auditImpl = opts.audit || audit();
 
+  // Screen operator-supplied generic-rDNS patterns ONCE at build time —
+  // they are .test()'d per-match against attacker-controlled rDNS / claim
+  // names, so a catastrophic-backtracking shape would be a ReDoS lever.
+  if (Array.isArray(opts.genericRdnsPatterns)) {
+    for (var gi = 0; gi < opts.genericRdnsPatterns.length; gi += 1) {
+      var gre = opts.genericRdnsPatterns[gi];
+      if (gre instanceof RegExp) {
+        guardRegex.assertSafe(gre, "mail.helo.evaluate: genericRdnsPatterns[" + gi + "]",
+          MailHeloError, "mail-helo/unsafe-pattern");
+      }
+    }
+  }
+
   if (!ctx || typeof ctx !== "object") {
     throw new MailHeloError("mail-helo/bad-input",
       "evaluate: ctx must be a plain object");

package/lib/mcp.js

@@ -37,6 +37,8 @@ var safeJson = require("./safe-json");
 var safeBuffer = require("./safe-buffer");
 var requestHelpers = require("./request-helpers");
 var audit = require("./audit");
+var lazyRequire = require("./lazy-require");
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 var { McpError } = require("./framework-error");
 
 var TOOL_NAME_MAX     = 64;                                                                  // string-length cap, not bytes
@@ -642,8 +644,14 @@ function _validateValueAgainstSchema(value, schema, path) {
       // cost scales with the number of code units the engine scans, so 4096
       // chars is the correct ReDoS bound regardless of UTF-8 byte size.
       if (value.length > 4096) return path + ": value exceeds 4096-char cap before regex test";    // ReDoS char cap (not bytes)
+      // The input-length cap above does NOT bound catastrophic backtracking
+      // (a `(a+)+$` pattern blows up at ~40 input chars). Screen the tool
+      // author's pattern through b.guardRegex so a ReDoS-shaped schema pattern
+      // can't pin a CPU when matched against request input.
+      try { guardRegex().assertSafe(schema.pattern, path); }
+      catch (_ge) { return path + ": schema pattern rejected as unsafe (ReDoS shape)"; }
       try {
-        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern from registered tool author, not request input; bounded above
+        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern is ReDoS-screened via guardRegex.assertSafe above + input length-capped
         if (!pat.test(value)) return path + ": does not match pattern";
       }
       catch (_e) { return path + ": invalid pattern in schema"; }

package/lib/middleware/bot-guard.js

@@ -54,6 +54,7 @@ var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 var audit = lazyRequire(function () { return require("../audit"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 
 var BotGuardError = defineClass("BotGuardError", { alwaysPermanent: true });
 
@@ -64,7 +65,13 @@ var BotGuardError = defineClass("BotGuardError", { alwaysPermanent: true });
 // constructing patterns dynamically compile at their own call site so
 // the pattern source is visible in their code.
 function _coerceAgentPattern(r, where) {
-  if (r instanceof RegExp) return r;
+  if (r instanceof RegExp) {
+    // Screen the operator's pattern for catastrophic-backtracking (ReDoS)
+    // shapes ONCE at create()-time — it is later .test()'d against the
+    // attacker-controlled User-Agent on every request.
+    guardRegex().assertSafe(r, where, BotGuardError, "bot-guard/unsafe-pattern");
+    return r;
+  }
   throw new BotGuardError("bot-guard/bad-pattern",
     where + " must be a RegExp instance; got " + (typeof r) +
     " (compile the pattern at the call site so the source is visible " +

package/lib/middleware/cors.js

@@ -52,6 +52,7 @@
 var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var audit = lazyRequire(function () { return require("../audit"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 var requestHelpers = require("../request-helpers");
 var safeUrl = require("../safe-url");
 var validateOpts = require("../validate-opts");
@@ -237,6 +238,10 @@ function create(opts) {
       }
       origins.push({ kind: "string", canonical: canonEntry, original: entry });
     } else if (entry instanceof RegExp) {
+      // Screen the operator's RegExp once at create() time for
+      // catastrophic-backtracking (ReDoS) shapes before it ever runs
+      // .test() against an attacker-controlled Origin header per request.
+      guardRegex().assertSafe(entry, "middleware.cors: origins[" + oi + "]", CorsError, "cors/unsafe-pattern");
       origins.push({ kind: "regex", pattern: entry });
     } else {
       throw new CorsError("cors/bad-origin",

package/lib/middleware/request-log.js

@@ -29,6 +29,7 @@
  * for fully custom logic (e.g. "warn" only on slow-path requests).
  */
 var C = require("../constants");
+var guardRegex = require("../guard-regex");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 
@@ -95,6 +96,9 @@ function create(opts) {
     if (typeof skipPaths[i] !== "string" && !(skipPaths[i] instanceof RegExp)) {
       throw new Error("middleware.requestLog: skipPaths[" + i + "] must be a string prefix or RegExp");
     }
+    if (skipPaths[i] instanceof RegExp) {
+      guardRegex.assertSafe(skipPaths[i], "middleware.requestLog: skipPaths[" + i + "]");
+    }
   }
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;

package/lib/middleware/span-http-server.js

@@ -49,6 +49,7 @@ var { defineClass } = require("../framework-error");
 var SpanHttpError = defineClass("SpanHttpError", { alwaysPermanent: true });
 
 var observability = lazyRequire(function () { return require("../observability"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 
 function _shouldIgnore(path, ignorePaths) {
   if (!ignorePaths || !Array.isArray(ignorePaths)) return false;
@@ -177,6 +178,15 @@ function create(opts) {
   var tracer            = opts.tracer;
   var onEnd             = opts.onEnd || null;
   var ignorePaths       = opts.ignorePaths || null;
+  if (Array.isArray(ignorePaths)) {
+    for (var ip = 0; ip < ignorePaths.length; ip++) {
+      if (ignorePaths[ip] instanceof RegExp) {
+        guardRegex().assertSafe(ignorePaths[ip],
+          "middleware.spanHttpServer: ignorePaths[" + ip + "]",
+          SpanHttpError, "span-http/unsafe-pattern");
+      }
+    }
+  }
   var captureReqHeaders = opts.captureRequestHeaders || null;
   var captureResHeaders = opts.captureResponseHeaders || null;
   var spanNameFn        = opts.spanNameFn || null;

package/lib/request-helpers.js

@@ -49,6 +49,9 @@ var lazyRequire = require("./lazy-require");
 // required very early in the boot graph. Only touched at middleware-construction
 // time by trustedClientIp(), never on the hot path.
 var _ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
+// Lazy for the same boot-graph reason — only touched at middleware-construction
+// time by makeSkipMatcher() to screen operator-supplied skip RegExps for ReDoS.
+var _guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 
 var HTTP_STATUS = Object.freeze({
   OK:                            0xC8,
@@ -991,6 +994,12 @@ function makeSkipMatcher(opts, label) {
       throw new TypeError(label + ": skipPaths[" + i + "] must be a string prefix or RegExp, got " +
         typeof skipPaths[i]);
     }
+    // Screen operator-supplied skip RegExps for catastrophic-backtracking
+    // shapes once at construction time — they later run .test() against
+    // attacker-controlled request paths on the hot path.
+    if (skipPaths[i] instanceof RegExp) {
+      _guardRegex().assertSafe(skipPaths[i], label + ": skipPaths[" + i + "]");
+    }
   }
   var skipFn = opts.skip;
   if (skipFn !== undefined && skipFn !== null && typeof skipFn !== "function") {

package/lib/self-update.js

@@ -54,6 +54,7 @@ var numericBounds = require("./numeric-bounds");
 var atomicFile = require("./atomic-file");
 var validateOpts = require("./validate-opts");
 var bCrypto = require("./crypto");
+var guardRegex = require("./guard-regex");
 var httpClient = require("./http-client");
 var safeJson = require("./safe-json");
 var { URL: NodeUrl } = require("node:url");
@@ -242,12 +243,25 @@ function _validatePollOpts(opts) {
         throw new SelfUpdateError("selfupdate/bad-asset-pattern",
           "selfUpdate.poll: opts.assetPattern must be a RegExp or string when present");
       }
+      // Screen an operator-supplied RegExp once at config-time; it is
+      // later .test()'d against attacker-controlled asset names in the
+      // request path, so a catastrophic-backtracking shape would be a
+      // per-request DoS. The string form is matched by substring
+      // (indexOf), never compiled, so it carries no ReDoS risk.
+      if (value instanceof RegExp) {
+        guardRegex.assertSafe(value, "selfUpdate: assetPattern",
+          SelfUpdateError, "selfupdate/unsafe-asset-pattern");
+      }
     },
     signaturePattern: function (value) {
       if (value !== undefined && !(value instanceof RegExp) && typeof value !== "string") {
         throw new SelfUpdateError("selfupdate/bad-sig-pattern",
           "selfUpdate.poll: opts.signaturePattern must be a RegExp or string when present");
       }
+      if (value instanceof RegExp) {
+        guardRegex.assertSafe(value, "selfUpdate: signaturePattern",
+          SelfUpdateError, "selfupdate/unsafe-sig-pattern");
+      }
     },
     maxBytes: function (value) {
       numericBounds.requirePositiveFiniteIntIfPresent(value,

package/lib/static.js

@@ -60,6 +60,7 @@ var observability = lazyRequire(function () { return require("./observability");
 // import cycles. Operators opt out via contentSafety: null (audited).
 var guardAll = lazyRequire(function () { return require("./guard-all"); });
 var guardFilename = lazyRequire(function () { return require("./guard-filename"); });
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 
 var _err = StaticServeError.factory;
 
@@ -521,6 +522,13 @@ function _validateCreateOpts(opts) {
       if (value !== undefined && value !== null && !(value instanceof RegExp)) {
         throw errorClass.factory(code, "staticServe.create: hashedPathPattern must be a RegExp");
       }
+      // Screen the operator-supplied pattern once at create() time — it is
+      // .test()'d against the attacker-controlled request path on every
+      // download, so a catastrophic-backtracking (ReDoS) shape would be a
+      // per-request DoS. Reject the unsafe pattern at config time instead.
+      if (value instanceof RegExp) {
+        guardRegex().assertSafe(value, "staticServe: hashedPathPattern", StaticServeError, "static/unsafe-pattern");
+      }
     },
     // indexFile === null is the operator's "disable" sentinel; the helper
     // returns null/undefined unchanged so we keep that semantic.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.37",
+  "version": "0.15.39",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a1be0521-cb1d-4b8e-9ed6-b0053b5b9bfd",
+  "serialNumber": "urn:uuid:861fafcf-aa1c-4e00-b8a0-ed9942340f9c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-27T09:36:13.300Z",
+    "timestamp": "2026-06-28T04:47:31.828Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.37",
+      "bom-ref": "@blamejs/core@0.15.39",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.37",
+      "version": "0.15.39",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.37",
+      "purl": "pkg:npm/%40blamejs/core@0.15.39",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.37",
+      "ref": "@blamejs/core@0.15.39",
       "dependsOn": []
     }
   ]