@blamejs/core 0.15.38 → 0.15.39

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.39 (2026-06-27) — **Nine more places that matched an operator-supplied regex against request data — User-Agent, Origin, request path, form fields, SMTP HELO, release-asset names — now screen the pattern for catastrophic backtracking (ReDoS) before use, and a new b.guardRegex.assertSafe helper makes that screening one call.** The previous release screened feature-flag and MCP regex patterns for ReDoS but did not sweep every place the framework matches an operator-supplied regex against attacker-controlled input. Nine more were found and fixed: the bot guard (User-Agent), CORS (Origin), the HTTP span middleware and the shared request skip-matcher used by CSRF / fetch-metadata / rate-limit / access-lock / age-gate and the request logger (request path), static serving (hashed-asset path pattern), form field validation (submitted field value), SMTP HELO generic-rDNS patterns (HELO name), and the self-updater's asset/signature patterns (names from a remote release feed). Each accepted an operator RegExp with only a type check and ran it on every matching request, so an accidentally catastrophic pattern such as (a+)+$ or ((a)+)+$ could pin a CPU on a crafted input — a length cap does not bound backtracking. Every one now screens the pattern through b.guardRegex at configuration time. A new b.guardRegex.assertSafe(input, label?, ErrorClass?, code?) primitive performs that screen in one call (accepting a RegExp or a pattern string), which operators can also use on their own patterns. **Added:** *b.guardRegex.assertSafe — screen a RegExp or pattern string for ReDoS in one call* — b.guardRegex.assertSafe(input, label?, ErrorClass?, code?, opts?) screens an already-compiled RegExp (its source) or a raw pattern string for the catastrophic-backtracking classes — nested, alternation-with, and lookaround quantifiers — throwing the supplied framework-error class (or the underlying GuardRegexError) on a hostile pattern and returning the input on success. It allows large or open-ended bounded repeats (`{8,}`, `{n,m}`): a single counted repeat matches in linear time and legitimate patterns (including the framework's own defaults) use them. It is the config-time guard used by the request-lifecycle fixes above, and operators can apply it to their own patterns before matching them against untrusted input. **Security:** *Operator regex patterns matched against request data are screened for ReDoS framework-wide* — An operator-supplied RegExp matched against attacker-controllable input is a denial-of-service surface if it has a catastrophic-backtracking shape: the input triggers exponential work in the regex engine. Nine sites accepted such patterns with only an `instanceof RegExp` type check and executed them per request — bot-guard against the User-Agent, CORS against the Origin header, the HTTP span middleware and the shared skip-path matcher (CSRF / fetch-metadata / rate-limit / access-lock / age-gate / request-log) against the request path, static serving against the request path, form validation against the submitted field value, SMTP HELO checks against the HELO name, and the self-updater against asset names from a remote release feed. Each now routes the pattern through b.guardRegex at configuration time, so a catastrophic shape is refused up front instead of being weaponized by a crafted request. A length bound on the input is not a defense: a nested-quantifier pattern backtracks catastrophically at a few dozen characters. **Detectors:** *Build guard: an operator regex matched against request input must be ReDoS-screened* — A codebase guard now fails the build if a primitive accepts an operator-supplied RegExp and executes it against request input without screening the pattern through b.guardRegex.assertSafe — so the catastrophic-backtracking class fixed in this release cannot be reintroduced at a new site (the trusted-input cases — local filesystem paths, operator config keys, operator-owned schemas — are explicitly allowlisted). · *Build guard: process.moduleLoadList filters must match the 'NativeModule X' naming* — A guard now fails the build if a test filters process.moduleLoadList by the 'node:X' name only. Node 20+ records a loaded builtin as 'NativeModule X', so a 'node:'-only filter in an edge-runtime no-eager-load test would rot green and miss a reintroduced top-level networking require.
+
 - v0.15.38 (2026-06-27) — **Regex patterns supplied in feature-flag targeting rules and MCP tool input schemas are now screened for catastrophic-backtracking (ReDoS) shapes before compilation, so a pattern matched against request data can't pin a CPU.** Two places compiled a caller-supplied regex pattern and `.test()`'d it against request-controlled input with only a length bound as the stated defense: a feature-flag targeting condition (`op: "regex"`) matched against runtime attribute values, and an MCP tool's input-schema `pattern` matched against tool-call arguments. A length bound is not a ReDoS defense — a catastrophic-backtracking pattern such as `(a+)+$` is six characters and pins a CPU on a crafted input. Both patterns now pass through `b.guardRegex` (strict profile) before compilation, which refuses nested-quantifier, alternation-with-quantifier, and quantifier-inside-lookaround shapes. A ReDoS-shaped flag pattern is refused when the rules are validated; a ReDoS-shaped MCP schema pattern fails tool-input validation. Patterns built from the framework's own static tables, operator-owned JSON Schema patterns, the Sieve glob translator (which cannot express nested quantifiers), and the I-Regexp translator (linear by dialect) are unchanged. **Security:** *Feature-flag regex targeting conditions are screened for ReDoS before compilation* — A flag targeting rule with `op: "regex"` compiled the operator-supplied pattern and `.test()`'d it against runtime attribute values, guarded only by a 200-character length cap. Length does not bound catastrophic backtracking, so a pattern like `(a+)+$` combined with an attacker-controlled attribute value could pin a CPU during flag evaluation. The pattern is now screened through b.guardRegex (strict) when the rules are validated, and a catastrophic-backtracking shape is refused with a clear error. · *MCP tool input-schema patterns are screened for ReDoS before matching request input* — b.mcp.validateToolInput compiled a tool author's input-schema `pattern` and matched it against tool-call argument values; the 4096-character input cap does not bound backtracking (a `(a+)+$` pattern blows up at roughly forty input characters). The schema pattern is now screened through b.guardRegex (strict) before compilation, so a ReDoS-shaped pattern in a registered tool's schema fails input validation instead of letting hostile arguments hang the validator. · *b.guardRegex now catches wrapped nested-quantifier patterns* — The nested-quantifier detector matched a quantified group whose body contained a quantifier, but its inner match was paren-blind, so wrapping the inner quantifier in an extra group — `((a)+)+`, `(([a-z]+)*)*`, `((a+))+` — slipped past it while remaining catastrophic. A structural scan now tracks group nesting and refuses an unbounded-quantified group whose body itself contains an unbounded quantifier at any depth, so the wrapped forms are rejected alongside the bare `(a+)+`. Bounded repeats (`{n}`, `{n,m}`) are unaffected. This strengthens every b.guardRegex caller, including the flag-targeting and MCP screening above.
 
 - v0.15.37 (2026-06-27) — **Several numeric options that silently accepted a non-finite value — disabling a clock-skew / freshness check or a resource cap — now reject it, so an `Infinity` skew or limit can no longer turn off the protection it configures.** A number of configuration options validated a numeric value with a bare `typeof === "number" && value >= 0` check, which accepts `Infinity`. Where the value is a clock-skew tolerance or a resource cap, an `Infinity` (or `NaN`) silently disabled the very check it tunes: a CWT / OCSP-staple / ARC clock-skew of `Infinity` made the expiry, freshness, and expiration comparisons unsatisfiable (an expired token / a replayed pre-revocation "good" response / an expired ARC seal would be accepted); a WebSocket-client `maxMessageBytes` / `maxFrameBytes` / `handshakeTimeoutMs` of `Infinity` disabled the inbound-OOM and stalled-handshake defenses; and inbox / flag-cache / audit-chain size and count caps of `Infinity` admitted unbounded data. These options now route through the finite-bounds validator: a present non-finite value is refused at the entry point (or falls back to the safe default on the result-returning paths). Options where an unbounded value is a deliberate intent — reconnect "retry indefinitely", inbox "retain indefinitely" — continue to accept `Infinity`. **Security:** *A non-finite clock-skew no longer disables CWT / OCSP / ARC time checks* — b.cwt.verify, the OCSP-staple freshness check in b.network.tls, and b.mail.arc.verify each took an operator clock-skew tolerance validated as `typeof === "number" && >= 0`, which accepts `Infinity`. Because each check is of the form `now > deadline + skew`, a skew of `Infinity` made it unsatisfiable and silently turned the check off: an expired CWT verified, a stale (post-nextUpdate) OCSP "good" response — the exact reply an attacker replays after the certificate is revoked — was accepted, and an expired ARC seal passed. A present clock-skew that is not a non-negative finite integer is now refused (b.cwt.verify throws cwt/bad-clock-skew; the OCSP and ARC paths fall back to their safe default). Regression tests assert an expired token / stale staple / expired ARC seal is still rejected when the skew is `Infinity`. · *WebSocket-client inbound caps can no longer be disabled by an Infinity value* — b.wsClient.connect validated maxMessageBytes, maxFrameBytes, and handshakeTimeoutMs (and the ping/pong keepalive intervals) with a bare numeric check that accepted `Infinity`, which disabled the inbound-message and frame size limits — the defenses against a malicious server sending an unbounded message — and the handshake timeout. A present non-finite value for these is now refused at connect time. The reconnect maxAttempts still accepts `Infinity` (a deliberate "reconnect indefinitely" intent). · *Inbox, flag-cache, and audit-chain caps reject a non-finite limit* — The inbox maxPayloadBytes / messageIdMaxLen / sourceMaxLen caps, the flag-cache ttlMs / maxEntries, and the audit-chain partition fan-out cap each accepted `Infinity`, disabling the cap (unbounded stored payloads, a never-expiring or unbounded cache, unbounded fan-out). These now require a positive finite integer — refused at create time, or clamped to the bounded default on the result-returning verify path. The inbox retentionDays still accepts `Infinity` (retain indefinitely).

package/lib/flag-targeting.js

@@ -178,14 +178,9 @@ function validateRules(rules, label) {
         // bound does NOT defend ReDoS (`(a+)+$` is 6 chars); screen the pattern
         // through b.guardRegex first — it refuses nested-quantifier / alternation-
         // quantifier / lookaround-quantifier shapes before compilation.
+        guardRegex().assertSafe(cond.value, clabel + ".value", FlagError, "flag/bad-condition");
         try {
-          guardRegex().sanitize(cond.value, { profile: "strict" });
-        } catch (ge) {
-          throw new FlagError("flag/bad-condition",
-            clabel + ".value: regex pattern rejected as unsafe (ReDoS shape) - " + ge.message);
-        }
-        try {
-          // allow:dynamic-regex — operator targeting pattern, ReDoS-screened via guardRegex.sanitize (strict) + length-bounded to 200 chars above
+          // allow:dynamic-regex — operator targeting pattern, ReDoS-screened via guardRegex.assertSafe + length-bounded to 200 chars above
           validatedCond._compiledRegex = new RegExp(cond.value);
         } catch (e) {
           throw new FlagError("flag/bad-condition",

package/lib/forms.js

@@ -34,6 +34,7 @@
  */
 var C = require("./constants");
 var { generateToken, timingSafeEqual } = require("./crypto");
+var guardRegex = require("./guard-regex");
 var safeSchema = require("./safe-schema");
 var safeUrl = require("./safe-url");
 var template = require("./template");
@@ -198,6 +199,10 @@ function _renderInput(field) {
         "'.pattern must be a pre-compiled RegExp; got " +
         (typeof field.pattern) + ". Wrap the source string with `RegExp` at config time.");
     }
+    // Screen the operator-supplied pattern for catastrophic-backtracking
+    // (ReDoS) shapes at config time so a hostile-form-spec can't stage a
+    // pathological regex against the engine.
+    guardRegex.assertSafe(field.pattern, "forms: field[" + field.name + "].pattern");
     attrs.push('pattern="' + escapeAttribute(field.pattern.source) + '"');
   }
   if (field.min !== undefined)        attrs.push('min="' + escapeAttribute(field.min) + '"');
@@ -490,6 +495,10 @@ function validate(spec, body) {
             "'.pattern must be a pre-compiled RegExp; got " +
             (typeof f.pattern) + ". Wrap the source string with `RegExp` at config time.");
         }
+        // Screen the operator-supplied pattern for catastrophic-backtracking
+        // (ReDoS) shapes before the test, so a pathological regex can't be
+        // run against the submitted value.
+        guardRegex.assertSafe(f.pattern, "forms: field[" + f.name + "].pattern");
         if (!f.pattern.test(coerced)) {
           errors[f.name] = f.errorMessages && f.errorMessages.pattern
             ? f.errorMessages.pattern

package/lib/guard-regex.js

@@ -512,6 +512,61 @@ function gate(opts) {
 // ---- adaptive integration-test fixtures (consumed by layer-5 host harness) ----
 var INTEGRATION_FIXTURES = gateContract.identifierFixtures("^[a-z]+$", "(a+)+b");
 
+/**
+ * @primitive  b.guardRegex.assertSafe
+ * @signature  b.guardRegex.assertSafe(input, label?, ErrorClass?, code?, opts?)
+ * @since      0.15.39
+ * @status     stable
+ * @related    b.guardRegex.sanitize, b.guardRegex.validate
+ *
+ * Screen an already-compiled <code>RegExp</code> (or a raw pattern string) for
+ * catastrophic-backtracking (ReDoS) shapes, throwing if the pattern is unsafe.
+ * This is the config-time guard for request-lifecycle code that matches an
+ * operator-supplied regex against attacker-controlled input (User-Agent,
+ * Origin, request path, form field, HELO) — an accidentally-catastrophic
+ * operator pattern would otherwise be a per-request DoS once a hostile input
+ * triggers the backtracking.
+ *
+ * Pass a <code>RegExp</code> instance (its <code>.source</code> is screened) or
+ * a pattern string. On a hostile shape it throws <code>ErrorClass(code, ...)</code>
+ * when an error class is supplied, otherwise the underlying
+ * <code>GuardRegexError</code>. Returns the input unchanged on success.
+ *
+ * By default it rejects the catastrophic-backtracking classes — nested,
+ * alternation-with, and lookaround quantifiers — but ALLOWS large/open bounded
+ * repeats (<code>{8,}</code>, <code>{n,m}</code>): a single counted repeat is
+ * linear, not exponential, and legitimate patterns (e.g. a hex hash of 8+
+ * digits) use them. Pass an explicit <code>opts</code> to override.
+ *
+ * @opts
+ *   profile:             string,   // guardRegex profile (default: "strict")
+ *   boundedRepeatPolicy: string,   // default: "allow" (large bounded repeats are linear)
+ *
+ * @example
+ *   b.guardRegex.assertSafe(/^[a-z]+$/);            // ok — returns the RegExp
+ *   b.guardRegex.assertSafe(/\.[a-f0-9]{8,}\./);    // ok — a single bounded repeat is linear
+ *   try { b.guardRegex.assertSafe(/((a)+)+$/); }    // throws — nested quantifier
+ *   catch (e) { e.code; }                           // → "regex/unsafe-pattern"
+ */
+function assertSafe(input, label, ErrorClass, code, opts) {
+  var source = (input instanceof RegExp) ? input.source : input;
+  try {
+    // Screen the catastrophic-backtracking classes (nested / alternation /
+    // lookaround quantifiers — held at every profile) but allow large bounded
+    // repeats: a counted repeat matches in linear time, and rejecting `{n,}`
+    // would refuse legitimate operator patterns (and the framework's own
+    // defaults, e.g. b.staticServe.DEFAULT_HASHED_PATTERN's `{8,}`).
+    _guard.sanitize(source, opts || { profile: "strict", boundedRepeatPolicy: "allow" });
+  } catch (e) {
+    if (ErrorClass) {
+      throw new ErrorClass(code || "regex/unsafe-pattern",
+        (label || "regex") + ": pattern rejected as unsafe (ReDoS shape) - " + (e && e.message));
+    }
+    throw e;
+  }
+  return input;
+}
+
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
@@ -530,3 +585,5 @@ var _guard = module.exports = gateContract.defineGuard({
   intOpts:           ["maxBytes", "maxPatternBytes", "maxBoundedRepeat", "maxConsecutiveStars"],
   gate:        gate,
 });
+
+_guard.assertSafe = assertSafe;

package/lib/mail-helo.js

@@ -105,6 +105,7 @@ var { defineClass }    = require("./framework-error");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
 var gateContract       = require("./gate-contract");
+var guardRegex         = require("./guard-regex");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
@@ -210,6 +211,19 @@ async function evaluate(ctx, opts) {
   var selfNames = (opts.selfNames || []).map(function (n) { return String(n).toLowerCase(); });
   var auditImpl = opts.audit || audit();
 
+  // Screen operator-supplied generic-rDNS patterns ONCE at build time —
+  // they are .test()'d per-match against attacker-controlled rDNS / claim
+  // names, so a catastrophic-backtracking shape would be a ReDoS lever.
+  if (Array.isArray(opts.genericRdnsPatterns)) {
+    for (var gi = 0; gi < opts.genericRdnsPatterns.length; gi += 1) {
+      var gre = opts.genericRdnsPatterns[gi];
+      if (gre instanceof RegExp) {
+        guardRegex.assertSafe(gre, "mail.helo.evaluate: genericRdnsPatterns[" + gi + "]",
+          MailHeloError, "mail-helo/unsafe-pattern");
+      }
+    }
+  }
+
   if (!ctx || typeof ctx !== "object") {
     throw new MailHeloError("mail-helo/bad-input",
       "evaluate: ctx must be a plain object");

package/lib/mcp.js

@@ -648,10 +648,10 @@ function _validateValueAgainstSchema(value, schema, path) {
       // (a `(a+)+$` pattern blows up at ~40 input chars). Screen the tool
       // author's pattern through b.guardRegex so a ReDoS-shaped schema pattern
       // can't pin a CPU when matched against request input.
-      try { guardRegex().sanitize(schema.pattern, { profile: "strict" }); }
+      try { guardRegex().assertSafe(schema.pattern, path); }
       catch (_ge) { return path + ": schema pattern rejected as unsafe (ReDoS shape)"; }
       try {
-        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern is ReDoS-screened via guardRegex.sanitize (strict) above + input length-capped
+        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern is ReDoS-screened via guardRegex.assertSafe above + input length-capped
         if (!pat.test(value)) return path + ": does not match pattern";
       }
       catch (_e) { return path + ": invalid pattern in schema"; }

package/lib/middleware/bot-guard.js

@@ -54,6 +54,7 @@ var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 var audit = lazyRequire(function () { return require("../audit"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 
 var BotGuardError = defineClass("BotGuardError", { alwaysPermanent: true });
 
@@ -64,7 +65,13 @@ var BotGuardError = defineClass("BotGuardError", { alwaysPermanent: true });
 // constructing patterns dynamically compile at their own call site so
 // the pattern source is visible in their code.
 function _coerceAgentPattern(r, where) {
-  if (r instanceof RegExp) return r;
+  if (r instanceof RegExp) {
+    // Screen the operator's pattern for catastrophic-backtracking (ReDoS)
+    // shapes ONCE at create()-time — it is later .test()'d against the
+    // attacker-controlled User-Agent on every request.
+    guardRegex().assertSafe(r, where, BotGuardError, "bot-guard/unsafe-pattern");
+    return r;
+  }
   throw new BotGuardError("bot-guard/bad-pattern",
     where + " must be a RegExp instance; got " + (typeof r) +
     " (compile the pattern at the call site so the source is visible " +

package/lib/middleware/cors.js

@@ -52,6 +52,7 @@
 var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var audit = lazyRequire(function () { return require("../audit"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 var requestHelpers = require("../request-helpers");
 var safeUrl = require("../safe-url");
 var validateOpts = require("../validate-opts");
@@ -237,6 +238,10 @@ function create(opts) {
       }
       origins.push({ kind: "string", canonical: canonEntry, original: entry });
     } else if (entry instanceof RegExp) {
+      // Screen the operator's RegExp once at create() time for
+      // catastrophic-backtracking (ReDoS) shapes before it ever runs
+      // .test() against an attacker-controlled Origin header per request.
+      guardRegex().assertSafe(entry, "middleware.cors: origins[" + oi + "]", CorsError, "cors/unsafe-pattern");
       origins.push({ kind: "regex", pattern: entry });
     } else {
       throw new CorsError("cors/bad-origin",

package/lib/middleware/request-log.js

@@ -29,6 +29,7 @@
  * for fully custom logic (e.g. "warn" only on slow-path requests).
  */
 var C = require("../constants");
+var guardRegex = require("../guard-regex");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 
@@ -95,6 +96,9 @@ function create(opts) {
     if (typeof skipPaths[i] !== "string" && !(skipPaths[i] instanceof RegExp)) {
       throw new Error("middleware.requestLog: skipPaths[" + i + "] must be a string prefix or RegExp");
     }
+    if (skipPaths[i] instanceof RegExp) {
+      guardRegex.assertSafe(skipPaths[i], "middleware.requestLog: skipPaths[" + i + "]");
+    }
   }
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;

package/lib/middleware/span-http-server.js

@@ -49,6 +49,7 @@ var { defineClass } = require("../framework-error");
 var SpanHttpError = defineClass("SpanHttpError", { alwaysPermanent: true });
 
 var observability = lazyRequire(function () { return require("../observability"); });
+var guardRegex = lazyRequire(function () { return require("../guard-regex"); });
 
 function _shouldIgnore(path, ignorePaths) {
   if (!ignorePaths || !Array.isArray(ignorePaths)) return false;
@@ -177,6 +178,15 @@ function create(opts) {
   var tracer            = opts.tracer;
   var onEnd             = opts.onEnd || null;
   var ignorePaths       = opts.ignorePaths || null;
+  if (Array.isArray(ignorePaths)) {
+    for (var ip = 0; ip < ignorePaths.length; ip++) {
+      if (ignorePaths[ip] instanceof RegExp) {
+        guardRegex().assertSafe(ignorePaths[ip],
+          "middleware.spanHttpServer: ignorePaths[" + ip + "]",
+          SpanHttpError, "span-http/unsafe-pattern");
+      }
+    }
+  }
   var captureReqHeaders = opts.captureRequestHeaders || null;
   var captureResHeaders = opts.captureResponseHeaders || null;
   var spanNameFn        = opts.spanNameFn || null;

package/lib/request-helpers.js

@@ -49,6 +49,9 @@ var lazyRequire = require("./lazy-require");
 // required very early in the boot graph. Only touched at middleware-construction
 // time by trustedClientIp(), never on the hot path.
 var _ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
+// Lazy for the same boot-graph reason — only touched at middleware-construction
+// time by makeSkipMatcher() to screen operator-supplied skip RegExps for ReDoS.
+var _guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 
 var HTTP_STATUS = Object.freeze({
   OK:                            0xC8,
@@ -991,6 +994,12 @@ function makeSkipMatcher(opts, label) {
       throw new TypeError(label + ": skipPaths[" + i + "] must be a string prefix or RegExp, got " +
         typeof skipPaths[i]);
     }
+    // Screen operator-supplied skip RegExps for catastrophic-backtracking
+    // shapes once at construction time — they later run .test() against
+    // attacker-controlled request paths on the hot path.
+    if (skipPaths[i] instanceof RegExp) {
+      _guardRegex().assertSafe(skipPaths[i], label + ": skipPaths[" + i + "]");
+    }
   }
   var skipFn = opts.skip;
   if (skipFn !== undefined && skipFn !== null && typeof skipFn !== "function") {

package/lib/self-update.js

@@ -54,6 +54,7 @@ var numericBounds = require("./numeric-bounds");
 var atomicFile = require("./atomic-file");
 var validateOpts = require("./validate-opts");
 var bCrypto = require("./crypto");
+var guardRegex = require("./guard-regex");
 var httpClient = require("./http-client");
 var safeJson = require("./safe-json");
 var { URL: NodeUrl } = require("node:url");
@@ -242,12 +243,25 @@ function _validatePollOpts(opts) {
         throw new SelfUpdateError("selfupdate/bad-asset-pattern",
           "selfUpdate.poll: opts.assetPattern must be a RegExp or string when present");
       }
+      // Screen an operator-supplied RegExp once at config-time; it is
+      // later .test()'d against attacker-controlled asset names in the
+      // request path, so a catastrophic-backtracking shape would be a
+      // per-request DoS. The string form is matched by substring
+      // (indexOf), never compiled, so it carries no ReDoS risk.
+      if (value instanceof RegExp) {
+        guardRegex.assertSafe(value, "selfUpdate: assetPattern",
+          SelfUpdateError, "selfupdate/unsafe-asset-pattern");
+      }
     },
     signaturePattern: function (value) {
       if (value !== undefined && !(value instanceof RegExp) && typeof value !== "string") {
         throw new SelfUpdateError("selfupdate/bad-sig-pattern",
           "selfUpdate.poll: opts.signaturePattern must be a RegExp or string when present");
       }
+      if (value instanceof RegExp) {
+        guardRegex.assertSafe(value, "selfUpdate: signaturePattern",
+          SelfUpdateError, "selfupdate/unsafe-sig-pattern");
+      }
     },
     maxBytes: function (value) {
       numericBounds.requirePositiveFiniteIntIfPresent(value,

package/lib/static.js

@@ -60,6 +60,7 @@ var observability = lazyRequire(function () { return require("./observability");
 // import cycles. Operators opt out via contentSafety: null (audited).
 var guardAll = lazyRequire(function () { return require("./guard-all"); });
 var guardFilename = lazyRequire(function () { return require("./guard-filename"); });
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 
 var _err = StaticServeError.factory;
 
@@ -521,6 +522,13 @@ function _validateCreateOpts(opts) {
       if (value !== undefined && value !== null && !(value instanceof RegExp)) {
         throw errorClass.factory(code, "staticServe.create: hashedPathPattern must be a RegExp");
       }
+      // Screen the operator-supplied pattern once at create() time — it is
+      // .test()'d against the attacker-controlled request path on every
+      // download, so a catastrophic-backtracking (ReDoS) shape would be a
+      // per-request DoS. Reject the unsafe pattern at config time instead.
+      if (value instanceof RegExp) {
+        guardRegex().assertSafe(value, "staticServe: hashedPathPattern", StaticServeError, "static/unsafe-pattern");
+      }
     },
     // indexFile === null is the operator's "disable" sentinel; the helper
     // returns null/undefined unchanged so we keep that semantic.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.38",
+  "version": "0.15.39",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:742c0889-e56f-4bee-8220-91a6cac8307b",
+  "serialNumber": "urn:uuid:861fafcf-aa1c-4e00-b8a0-ed9942340f9c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-27T16:52:08.760Z",
+    "timestamp": "2026-06-28T04:47:31.828Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.38",
+      "bom-ref": "@blamejs/core@0.15.39",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.38",
+      "version": "0.15.39",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.38",
+      "purl": "pkg:npm/%40blamejs/core@0.15.39",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.38",
+      "ref": "@blamejs/core@0.15.39",
       "dependsOn": []
     }
   ]