@blamejs/core 0.15.67 → 0.15.68

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.68 (2026-07-02) — **A security-hardening release: mail delivery-status / return-receipt / ARC builders reject CR, LF, and NUL in header-line fields (header injection); the XML canonicalizer's nesting cap now actually fires (stack-overflow DoS on deeply-nested SAML/WebDAV input); and the Idempotency-Key replay cache is scoped to the authenticated principal (cross-actor response disclosure) — plus archive/SRS byte hardening.** b.mail composes RFC 3464 delivery-status notifications (b.mail.send.deliver(...).buildDsn, b.mailBounce.dsn.build), RFC 8098 message-disposition notifications (b.mailMdn.build), and RFC 8617 ARC signatures (b.mail.arc.sign) by interpolating operator- and peer-supplied values — recipient addresses, the reporting-MTA name, the remote server's 5xx diagnostic reply, and the ARC authserv-id / domain / selector — into `Name: value` header lines. A value containing a CR or LF let a hostile original sender (whose message is being bounced) or a malicious peer MX (whose 5xx reply is echoed into the DSN) inject an extra header or forge an additional multipart/report part. Structured fields (addresses, MTA names, identifiers) are now rejected outright, and the free-text 5xx diagnostic — which is legitimately multi-line — is folded to a single line. The same class is closed in two adjacent places: tar and zip entry names refuse CR/LF (a bare LF in an over-long tar name flowed into the POSIX pax extended header, where a crafted name could forge a `path=` record that overrides the ustar name and escapes the extraction directory), and SRS envelope-from rewriting refuses control characters in the address it re-emits as a MAIL FROM. A new b.safeBuffer.assertHeaderSafe primitive centralizes the reject-CR/LF/NUL check every header builder now composes. **Added:** *b.safeBuffer.assertHeaderSafe(value, label, ErrorClass, code)* — Throws when a string bound for a CRLF-delimited protocol line contains CR, LF, or a NUL byte, in the caller's own error domain. Structured header fields (addresses, domains, identifiers, MTA names) compose it to reject. · *b.safeBuffer.foldHeaderText(value, replacement?)* — Folds free-text bound for a header line onto one line — replaces every CR and LF with the replacement (default a space) and removes every NUL. Used for values that may legitimately wrap, such as a multi-line SMTP 5xx reply echoed into a DSN diagnostic line, where rejecting would be too strict; unlike a plain CR/LF strip it also removes NUL, which is never valid in a header value and is treated specially by downstream mail parsers. **Changed:** *Refreshed the vendored public-suffix list and the pinned CI action SHAs* — The vendored Mozilla Public Suffix List (which backs registrable-domain boundaries in b.guardDomain and cookie-scope checks) is refreshed to its current upstream revision, and the SHA-pinned GitHub Actions in the release and scanning workflows are bumped to their latest upstream releases. No operator action required. · *Concurrent DNS cache misses are coalesced into a single upstream lookup* — b.network.dns.resolver now single-flights in-flight queries: when several callers miss the cache for the same name at once, one upstream lookup is issued and the others await its result, instead of each firing its own request (a cache stampede that amplified load on the upstream resolver). Each caller still applies its own DNSSEC validate gate against the shared answer. **Security:** *Delivery-status notifications refuse header-injecting fields; the 5xx diagnostic is folded* — b.mail.send.deliver(...).buildDsn and b.mailBounce.dsn.build build an RFC 3464 multipart/report message from the failing recipient, the original sender, the reporting-MTA name, the enhanced status code, and the remote server's 5xx diagnostic reply. The 5xx reply is attacker-influenceable (it comes from the peer MX) and the addresses can come from a message being bounced. A CR or LF in any of these smuggled a new header or forged a report part into a message the operator then relays. Structured fields now reject CR/LF/NUL (the composer throws rather than emit an ambiguous message), and the free-text diagnostic is folded to one line so its text is preserved without introducing a line break. · *Message-disposition notifications refuse header-injecting fields* — b.mailMdn.build places the final recipient, original recipient, original message-id, reporting user-agent, and the From/To/Subject of the return receipt on header lines. Because an MDN is generated in response to an inbound message, these fields can carry attacker-chosen content; a CR or LF injected a header into the receipt. Each structured field now rejects CR/LF/NUL before the message is built. · *ARC signing refuses CR/LF/NUL in the authentication-results identity* — b.mail.arc.sign already refused CR/LF in the authentication-results value, but the ARC authserv-id, signing domain, and selector — interpolated verbatim into the ARC-Authentication-Results, ARC-Seal, and ARC-Message-Signature header block — were only checked for emptiness. A CR or LF in one of them injected a header into the signed block. All three now reject CR/LF/NUL. · *Archive entry names refuse CR/LF, closing a pax path-override escape* — tar and zip entry names already rejected a NUL byte and `..` segments but not CR/LF. In a tar archive, a bare LF in an over-long name flowed into the POSIX pax extended header (`len key=value\n`); because a pax `path=` record overrides the ustar header's name, a crafted name could inject an absolute `path=` record and write outside the extraction directory — an escape the `..` check does not catch. Both the tar and zip name normalizers now reject CR/LF. · *SRS envelope rewriting refuses control characters in the address* — b.mail.srs rewrite / srs1Rewrite / reverse embed the address they are given into the SRS0/SRS1 envelope address that becomes a subsequent SMTP MAIL FROM. They now reject CR/LF/NUL in the input address so a malformed address cannot be smuggled into an envelope command. · *The XML canonicalizer's nesting-depth cap now actually fires (stack-overflow DoS)* — b.xmlC14n.parse — the recursive-descent parser behind SAML and WebDAV canonicalization — carried a documented 200-level nesting cap that was dead: the depth counter was a per-frame-local incremented then decremented around each single recursive call, so it never exceeded 1 at the check. Deeply-nested untrusted XML recursed unbounded and overflowed the stack, crashing the process — a pre-authentication denial of service for any endpoint that canonicalizes attacker-supplied XML. The depth is now threaded through the recursion and enforced at entry, so nesting past the cap is refused before it can exhaust the stack. · *The Idempotency-Key replay cache is scoped to the authenticated principal* — b.middleware.idempotencyKey keyed its replay/response cache slot solely on the client-supplied Idempotency-Key header, with no binding to the authenticated principal. Two principals presenting the same (shared or guessed) key collided: one was served the other's cached response (cross-actor disclosure), or an attacker could pre-seed a key to force a 422 on the real client (cross-actor denial). The slot is now scoped to the authenticated principal, resolved via b.requestHelpers.extractActorContext and overridable with the new opts.scopeFn. Mount the middleware after authentication so the request carries the principal; slots for unauthenticated requests share a single anonymous scope. · *Mail and data parsers reject reserved prototype keys in untrusted input* — b.csv.parse, b.mime-parse (Content-Type parameters), b.eat (Entity Attestation Token claims), b.mailBimi (tiny-PS attributes), b.mailArf (feedback-report fields), and b.safeIcap (ICAP response headers) built plain objects keyed by names taken directly from untrusted input. A key of __proto__, constructor, or prototype would shadow or re-parent the object, letting an attacker taint a downstream type check. Every one of these sites now refuses the reserved keys — CSV throws csv/forbidden-header (an operator DDL surface); the parsers that must stay lenient drop the poisoned key and keep parsing. · *Verifiable-credential JOSE verification binds the algorithm to the key's curve* — b.vc.verify / b.vc.verifyPresentation resolved the public key and then verified with the algorithm named in the attacker-controlled JWS header, with no check that the two agree. A header claiming ES384 (or EdDSA) could be verified against a P-256 key an ECDSA curve/type confusion (CWE-347, RFC 7518 §3.4). The verifier now rejects any alg whose required curve/key-type doesn't match the resolved key, before the signature check. · *Span-event names are redacted on the telemetry wire* — The OTLP span exporter ran span names and exception messages through the telemetry redactor but passed span-EVENT names through verbatim, so a value-shape secret (a connection string, a token) placed in an event name egressed unredacted. Event names now route through the same redactor as span names, on both the JSON and protobuf wire paths. · *Session refresh enforces the idle and absolute timeout floors* — b.session.touch refreshed a session's activity timestamp without re-checking the idle / absolute timeout floors that b.session.verify enforces, so a floor-expired session could be resurrected by a refresh instead of being killed. Both floors are now evaluated on the refresh path (as on verify), and a session past either floor is deleted rather than extended.
+
 - v0.15.67 (2026-06-29) — **Path-scoped router middleware can no longer be bypassed by percent-encoding the request path: the router refuses an encoded path separator or null byte and decodes the path once, so a security gate and the resource it guards always agree on the path.** b.router supports path-scoped middleware — router.use('/admin', gate) runs a gate (requireAal, bearerAuth, requireMtls, csrfProtect, …) only for requests under a prefix. The gate matched the request path with its percent-escapes intact, while downstream consumers such as b.staticServe and router.serveStatic percent-decode the path before resolving the file. Because the gate and the consumer disagreed on decoding, an attacker could encode a character in the guarded segment (/%61dmin/secret) or hide a separator (/admin%2fsecret) so the gate's segment match missed while the consumer still reached the protected resource — an authentication, authorization, CSRF, or mTLS bypass for any resource served under a scoped gate. The router now refuses a request whose path contains an encoded path separator (%2f, %5c) or null byte (%00), and decodes the remaining escapes exactly once, so the gate, the route matcher, and every consumer act on a single canonical path. A request that legitimately needs those bytes was always ambiguous and is now rejected with 400 rather than silently routed two different ways. Route parameters captured from the path are now percent-decoded, matching the conventional behavior. **Changed:** *Encoded path separators and null bytes in the request path are refused; route params are decoded* — A request whose path contains %2f, %5c, or %00 is answered with 400 Bad Request — these have no unambiguous routing meaning (a consumer would treat them as a separator or terminator), and a request that needs a literal slash in a value should carry it in a query parameter. Path parameters captured by a route pattern (for example :id) are now percent-decoded before they reach the handler in req.params, matching conventional router behavior; handlers that previously received a still-encoded value will now receive the decoded form. **Security:** *Path-scoped middleware is no longer bypassable via percent-encoded paths* — A gate mounted with router.use(prefix, mw) matched req.pathname with percent-escapes preserved, but b.staticServe and router.serveStatic decode the path before resolving the resource. An attacker could percent-encode a character in the guarded segment (/%61dmin/secret, where %61 is 'a') so the segment compare saw '%61dmin' and skipped the gate, or hide a separator (/admin%2fsecret) so the gate saw one segment while the file resolver saw two — in both cases the protected resource was served without the gate running. The router now rejects a path containing an encoded separator (%2f/%5c) or null byte (%00) with 400, and percent-decodes the path exactly once before any path-scoped decision, so the gate and the resource it protects always resolve the same path. Operators who mounted authentication, authorization, CSRF, or mTLS gates with the scoped form no longer have a silent bypass beneath them.
 
 - v0.15.66 (2026-06-29) — **Recursive serializers and parsers refuse pathologically deep input with a typed error instead of overflowing the stack and crashing the process.** Several of the framework's recursive walkers over attacker-reachable input lacked an effective nesting cap, so a deeply nested value could exhaust the V8 call stack and throw an uncaught RangeError — crashing the process (a denial of service). b.canonicalJson is the most exposed: content-credentials verification canonicalises an untrusted manifest before it checks the signature, so a hostile credential could crash a verifier pre-authentication. b.jsonSchema.validate had a depth guard, but its limit was set so high the stack overflowed before the guard could fire, so validating a request body against a recursive schema crashed rather than returning a typed error. b.i18n.messageFormat parsed and rendered nested plural/select cases with no cap. Each walker now throws a typed framework error well before native overflow, and legitimate (even deeply nested) input is unaffected. The release also corrects DNSSEC signature-window comparison to the RFC 1982 serial-number arithmetic the spec requires, and makes the Redis client treat a malformed reply frame as a connection fault rather than letting it crash the host. **Fixed:** *DNSSEC compares RRSIG validity windows with RFC 1982 serial arithmetic* — b.network.dns.dnssec compared an RRSIG's inception and expiration against the current time by magnitude. RFC 4034 §3.1.5 requires the 32-bit timestamps to be interpreted with RFC 1982 serial-number arithmetic, which agrees with a plain comparison only while the values stay below 2^31. A signature whose window straddles the 2^31 (January 2038) or 2^32 (February 2106) boundary was mis-ordered — an in-window signature rejected, or a stale one accepted. The comparison now masks the clock into the same 32-bit serial space and tests the wrapped signed delta. **Security:** *Canonical JSON refuses excessively nested input before it can overflow the stack* — b.canonicalJson.stringify and stringifyJcs walk the value recursively. They detected circular references but had no nesting cap, so a deeply nested (acyclic) object or array overflowed the V8 stack with an uncaught RangeError. This is reachable before authentication: content-credentials verification canonicalises the untrusted manifest to hash it before verifying the signature, so a hostile credential could crash the verifier. Both serializers now throw a typed nesting-depth error at a depth far beyond any legitimate signed document and well short of native overflow. · *JSON Schema validation depth guard now fires before the stack overflows* — b.jsonSchema.validate caps subschema-validation nesting to defend against a recursive schema (for example items pointing back at the root with $ref) applied to a deeply nested instance — both attacker-controlled when validating a request body. The cap was set so high the V8 stack overflowed first, so the guard never ran and a crafted body crashed the validator with an uncaught RangeError instead of the typed reference-depth error. The limit is now well under native overflow; legitimate documents — deeply nested or wide — continue to validate. · *ICU MessageFormat refuses pathologically nested templates* — b.i18n.messageFormat.parse and format recurse once per nested plural/select case, with no depth cap. A template nested thousands of levels deep overflowed the stack. format() and parse() are public and b.i18n.t can render operator-supplied entries, so a hostile template is a denial-of-service vector; it now fails as a typed bad-template error. Real-world nesting (a handful of levels) is unaffected. · *Redis client treats a malformed reply frame as a connection fault, not a crash* — The RESP decoder recurses on nested arrays with no depth cap, and the data handler did not guard the parse, so a malformed or hostilely deep frame from a server threw out of the socket callback and could crash the host. The decoder now caps reply nesting and any parse fault tears the socket down and rejects in-flight commands for a reconnect — the same path as any other lost connection.

package/lib/archive-tar.js

@@ -70,6 +70,7 @@ var nodeStream = require("node:stream");
 var streamPromises = require("node:stream/promises");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var { defineClass } = require("./framework-error");
 
 var TarError = defineClass("TarError", { alwaysPermanent: true });
@@ -240,6 +241,12 @@ function _normalizeName(name) {
   if (name.indexOf("\u0000") !== -1) {
     throw new TarError("archive-tar/bad-name", "addFile: name contains null byte");
   }
+  // A bare LF flows into the POSIX pax extended header (`len key=value\n`),
+  // where a crafted name can forge a `path=` record that OVERRIDES the
+  // ustar name and escapes the extraction root; reject CR/LF outright.
+  if (safeBuffer.hasCrlf(name)) {
+    throw new TarError("archive-tar/bad-name", "addFile: name contains CR/LF");
+  }
   var normalized = name.replace(/\\/g, "/").replace(/^\/+/, "");
   var segs = normalized.split("/");
   for (var i = 0; i < segs.length; i += 1) {

package/lib/archive.js

@@ -59,6 +59,7 @@ var C = require("./constants");
 var { defineClass } = require("./framework-error");
 var auditEmit = require("./audit-emit");
 var atomicFile = require("./atomic-file");
+var safeBuffer = require("./safe-buffer");
 
 var ArchiveError = defineClass("ArchiveError", { alwaysPermanent: true });
 
@@ -219,6 +220,9 @@ function zip() {
     if (name.indexOf("\0") !== -1) {
       throw new ArchiveError("archive/bad-name", "addFile: name contains null byte");
     }
+    if (safeBuffer.hasCrlf(name)) {
+      throw new ArchiveError("archive/bad-name", "addFile: name contains CR/LF");
+    }
     // No path traversal — relative paths only, no leading slash, no ".." segments.
     var normalized = name.replace(/\\/g, "/").replace(/^\/+/, "");
     var segs = normalized.split("/");

package/lib/csv.js

@@ -43,6 +43,7 @@
  */
 var C = require("./constants");
 var numericBounds = require("./numeric-bounds");
+var pick = require("./pick");
 var { defineClass } = require("./framework-error");
 
 /**
@@ -292,7 +293,17 @@ function parse(input, opts) {
         "row " + r + " has " + rec.length + " fields, header has " + header.length);
     }
     var obj = {};
-    for (var i = 0; i < header.length; i++) obj[header[i]] = rec[i];
+    for (var i = 0; i < header.length; i++) {
+      // A header column named __proto__ / constructor / prototype would be
+      // written straight onto the row object, shadowing (constructor) or
+      // dropping/re-parenting (__proto__) the inherited slot — an attacker
+      // then controls a downstream `row.constructor` / type check. Refuse.
+      if (pick.isPoisonedKey(header[i])) {
+        throw new CsvError("csv/forbidden-header",
+          "header column '" + header[i] + "' is a reserved prototype key");
+      }
+      obj[header[i]] = rec[i];
+    }
     out.push(obj);
   }
   return out;

package/lib/eat.js

@@ -48,6 +48,7 @@
 
 var cwt = require("./cwt");
 var bCrypto = require("./crypto");
+var pick = require("./pick");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -229,7 +230,7 @@ async function verify(eat, opts) {
     if (name === "dbgstat" && typeof v === "number" && Object.prototype.hasOwnProperty.call(DBGSTAT_BY_VALUE, v)) {
       v = DBGSTAT_BY_VALUE[v];
     }
-    claims[name] = v;
+    if (!pick.isPoisonedKey(name)) claims[name] = v;
   });
 
   return { claims: claims, raw: raw, alg: out.alg, protectedHeaders: out.protectedHeaders };

package/lib/mail-arc-sign.js

@@ -188,12 +188,21 @@ function sign(opts) {
     throw new MailAuthError("arc-sign/bad-instance",
       "sign: instance must be an integer in [1, 50] — got " + JSON.stringify(opts.instance));
   }
-  validateOpts.requireNonEmptyString(opts.authservId,
-    "sign: authservId", MailAuthError, "arc-sign/bad-authserv");
-  validateOpts.requireNonEmptyString(opts.domain,
-    "sign: domain", MailAuthError, "arc-sign/bad-domain");
-  validateOpts.requireNonEmptyString(opts.selector,
-    "sign: selector", MailAuthError, "arc-sign/bad-selector");
+  // authservId / domain / selector / authResults are required non-empty
+  // strings AND are interpolated verbatim into the ARC header block
+  // (ARC-Authentication-Results / ARC-Seal / ARC-Message-Signature), so they
+  // can never carry a CR / LF / NUL — that would smuggle a header.
+  var arcHeaderFields = [
+    ["authservId",  opts.authservId,  "arc-sign/bad-authserv"],
+    ["domain",      opts.domain,      "arc-sign/bad-domain"],
+    ["selector",    opts.selector,    "arc-sign/bad-selector"],
+    ["authResults", opts.authResults, "arc-sign/bad-auth-results"],
+  ];
+  for (var fi = 0; fi < arcHeaderFields.length; fi += 1) {
+    var af = arcHeaderFields[fi];
+    validateOpts.requireNonEmptyString(af[1], "sign: " + af[0], MailAuthError, af[2]);
+    safeBuffer.assertHeaderSafe(af[1], af[0], MailAuthError, af[2]);
+  }
   if (!opts.privateKey || (typeof opts.privateKey !== "string" &&
       typeof opts.privateKey !== "object")) {
     throw new MailAuthError("arc-sign/missing-private-key",
@@ -216,12 +225,6 @@ function sign(opts) {
     throw new MailAuthError("arc-sign/cv-rule",
       "sign: i>=2 disallows cv=none — must be cv=pass or cv=fail (per RFC 8617 §5.1.1)");
   }
-  validateOpts.requireNonEmptyString(opts.authResults, "sign: authResults",
-    MailAuthError, "arc-sign/bad-auth-results");
-  if (safeBuffer.hasCrlf(opts.authResults)) {
-    throw new MailAuthError("arc-sign/bad-auth-results",
-      "sign: authResults contains CR/LF (header injection refused)");
-  }
   var headersToSign = opts.headersToSign || DEFAULT_HEADERS;
   if (!Array.isArray(headersToSign) || headersToSign.length === 0) {
     throw new MailAuthError("arc-sign/bad-headers",

package/lib/mail-arf.js

@@ -39,6 +39,7 @@
 
 var lazyRequire   = require("./lazy-require");
 var mimeParse     = require("./mime-parse");
+var pick          = require("./pick");
 var C             = require("./constants");
 var safeBuffer    = require("./safe-buffer");
 var { MailArfError } = require("./framework-error");
@@ -237,6 +238,7 @@ function parse(rawMessage, opts) {
     var f = reportFields[fi];
     if (!f || !f.name) continue;
     var lcName = f.name.toLowerCase();
+    if (pick.isPoisonedKey(lcName)) continue;
     fieldMap[lcName] = f.value;
   }
 

package/lib/mail-bimi.js

@@ -52,6 +52,7 @@ var nodeCrypto = require("node:crypto");
 
 var asn1 = require("./asn1-der");
 var C = require("./constants");
+var pick = require("./pick");
 var httpClient = require("./http-client");
 var lazyRequire = require("./lazy-require");
 var networkDnsResolver = lazyRequire(function () { return require("./network-dns-resolver"); });
@@ -572,7 +573,7 @@ function _parseTinyPsAttrs(src) {
   while ((m = re.exec(src)) !== null) {
     var name = m[1];
     var value = m[3] !== undefined ? m[3] : (m[4] !== undefined ? m[4] : (m[5] || ""));
-    attrs[name] = value;
+    if (!pick.isPoisonedKey(name)) attrs[name] = value;
   }
   return attrs;
 }

package/lib/mail-bounce.js

@@ -812,7 +812,11 @@ function _parseDsn(rawMessage) {
 
 function _foldFieldValue(name, value) {
   // RFC 5322 §2.2.3 — long lines fold at WSP. Keep it simple: emit
-  // `Name: value` and let downstream MTAs handle further folding.
+  // `Name: value` and let downstream MTAs handle further folding. This
+  // choke point emits a single `Name: value` line, so reject CR / LF /
+  // NUL in the value — an embedded terminator would smuggle a new field
+  // or forge a report part.
+  safeBuffer.assertHeaderSafe(value, name, MailBounceError, "bounce/bad-dsn-field");
   return name + ": " + value + "\r\n";
 }
 
@@ -836,10 +840,21 @@ function _buildDsn(opts) {
       String(opts.status) + "'");
   }
 
+  // CRLF/NUL header-injection guard. Recipients and MTA names are
+  // structured fields that can never legitimately carry CR / LF / NUL, so
+  // reject — a DSN built from a hostile recipient or peer must fail closed
+  // rather than smuggle a header or forge a report part. Diagnostic-Code
+  // echoes the remote server's SMTP reply (free text, legitimately
+  // multi-line), so fold it to a single line instead of rejecting.
+  safeBuffer.assertHeaderSafe(opts.finalRecipient, "finalRecipient", MailBounceError, "bounce/bad-dsn-field");
+  if (opts.originalRecipient != null) {
+    safeBuffer.assertHeaderSafe(opts.originalRecipient, "originalRecipient", MailBounceError, "bounce/bad-dsn-field");
+  }
   var reportingMta   = opts.reportingMta || "dns; localhost";
   var arrivalDate    = opts.arrivalDate  || new Date().toUTCString();
   var originalMessage = opts.originalMessage || null;
-  var diagnosticCode = opts.diagnosticCode || null;
+  var diagnosticCode = opts.diagnosticCode != null
+    ? safeBuffer.foldHeaderText(String(opts.diagnosticCode), " ") : null;
   var remoteMta      = opts.remoteMta || null;
   var humanText      = opts.humanText || (
     "This is the mail system at " + reportingMta + ".\r\n\r\n" +
@@ -854,10 +869,10 @@ function _buildDsn(opts) {
   var lines = [];
   lines.push("MIME-Version: 1.0");
   lines.push('Content-Type: multipart/report; report-type=delivery-status; boundary="' + boundary + '"');
-  if (opts.from)    lines.push("From: " + opts.from);
-  if (opts.to)      lines.push("To: " + opts.to);
-  if (opts.subject) lines.push("Subject: " + opts.subject);
-  if (opts.messageId) lines.push("Message-ID: " + opts.messageId);
+  if (opts.from)    lines.push("From: " + safeBuffer.assertHeaderSafe(opts.from, "from", MailBounceError, "bounce/bad-dsn-field"));
+  if (opts.to)      lines.push("To: " + safeBuffer.assertHeaderSafe(opts.to, "to", MailBounceError, "bounce/bad-dsn-field"));
+  if (opts.subject) lines.push("Subject: " + safeBuffer.assertHeaderSafe(opts.subject, "subject", MailBounceError, "bounce/bad-dsn-field"));
+  if (opts.messageId) lines.push("Message-ID: " + safeBuffer.assertHeaderSafe(opts.messageId, "messageId", MailBounceError, "bounce/bad-dsn-field"));
   lines.push("");
 
   // Part 1 - human-readable description.

package/lib/mail-mdn.js

@@ -31,6 +31,7 @@
 var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var mimeParse = require("./mime-parse");
+var safeBuffer = require("./safe-buffer");
 var structuredFields = require("./structured-fields");
 var audit = lazyRequire(function () { return require("./audit"); });
 var C = require("./constants");
@@ -210,6 +211,20 @@ function build(opts) {
       "and opts.requireUserConfirmation is not explicitly false (RFC 3798 §2.1)");
   }
 
+  // CRLF/NUL header-injection guard. Every structured MDN field
+  // (recipients, message-id, envelope headers, reporting UA) is a
+  // single-line header value that can never legitimately carry CR / LF /
+  // NUL — an inbound message must not be able to smuggle headers into the
+  // return receipt. Guard before addressType() so a hostile address fails
+  // closed with the mdn error, not an address-parse error.
+  safeBuffer.assertHeaderSafe(opts.finalRecipient, "finalRecipient", MailMdnError, "mdn/bad-header-field");
+  safeBuffer.assertHeaderSafe(opts.originalMessageId, "originalMessageId", MailMdnError, "mdn/bad-header-field");
+  if (opts.originalRecipient != null) safeBuffer.assertHeaderSafe(opts.originalRecipient, "originalRecipient", MailMdnError, "mdn/bad-header-field");
+  if (opts.reportingUserAgent != null) safeBuffer.assertHeaderSafe(opts.reportingUserAgent, "reportingUserAgent", MailMdnError, "mdn/bad-header-field");
+  if (opts.from != null) safeBuffer.assertHeaderSafe(opts.from, "from", MailMdnError, "mdn/bad-header-field");
+  if (opts.to != null) safeBuffer.assertHeaderSafe(opts.to, "to", MailMdnError, "mdn/bad-header-field");
+  if (opts.subject != null) safeBuffer.assertHeaderSafe(opts.subject, "subject", MailMdnError, "mdn/bad-header-field");
+
   var boundary = _generateBoundary();
   var recipType = mimeParse.addressType(opts.finalRecipient);
   var origRecipType = opts.originalRecipient ? mimeParse.addressType(opts.originalRecipient) : recipType;

package/lib/mail-send-deliver.js

@@ -62,6 +62,7 @@
 
 var nodeDns       = require("node:dns").promises;
 var bCrypto       = require("./crypto");
+var safeBuffer    = require("./safe-buffer");
 var validateOpts  = require("./validate-opts");
 var lazyRequire   = require("./lazy-require");
 var { defineClass } = require("./framework-error");
@@ -115,10 +116,19 @@ function _classifySmtpOutcome(err, response) {
 // headers per RFC 3462. Returns a raw RFC 5322 message ready to hand
 // to whatever transport the operator uses for DSN delivery.
 function _buildDsnMessage(opts) {
-  var from = opts.dsnFrom;
-  var to = opts.originalFrom;
-  var failedRecipient = opts.recipient;
-  var reason = opts.reason || "permanent failure";
+  // CRLF/NUL header-injection guard. Structured fields (addresses, the
+  // reporting-MTA name, the enhanced status code) can never legitimately
+  // carry CR / LF / NUL, so reject — a bounce built from a hostile
+  // original sender, or from a malicious peer MX, must fail closed rather
+  // than smuggle DSN headers or forge report parts. The 5xx `reason` is
+  // echoed from the peer's SMTP reply and is legitimately multi-line, so
+  // fold it to a single line instead of rejecting.
+  var from = safeBuffer.assertHeaderSafe(opts.dsnFrom, "dsnFrom", DeliverError, "deliver/bad-dsn-field");
+  var to = safeBuffer.assertHeaderSafe(opts.originalFrom, "originalFrom", DeliverError, "deliver/bad-dsn-field");
+  var failedRecipient = safeBuffer.assertHeaderSafe(opts.recipient, "recipient", DeliverError, "deliver/bad-dsn-field");
+  var reportingMta = safeBuffer.assertHeaderSafe(opts.reportingMta, "reportingMta", DeliverError, "deliver/bad-dsn-field");
+  var statusCode = safeBuffer.assertHeaderSafe(opts.statusCode, "statusCode", DeliverError, "deliver/bad-dsn-field");
+  var reason = safeBuffer.foldHeaderText(opts.reason || "permanent failure", " ");
   var origHeaders = opts.originalHeaders || "";
   var boundary = "dsn-" + bCrypto.generateToken(12);
   var nowIso = new Date().toUTCString();
@@ -134,7 +144,7 @@ function _buildDsnMessage(opts) {
     "--" + boundary + "\r\n" +
     "Content-Type: text/plain; charset=utf-8\r\n" +
     "\r\n" +
-    "This is the mail delivery system at " + (opts.reportingMta || from) + ".\r\n" +
+    "This is the mail delivery system at " + (reportingMta || from) + ".\r\n" +
     "\r\n" +
     "Your message to " + failedRecipient + " could not be delivered:\r\n" +
     "\r\n" +
@@ -147,12 +157,12 @@ function _buildDsnMessage(opts) {
     // (it falls back to the bounce-from's domain); it drives no auth decision or
     // delivery routing, so the leftmost-@ segment is acceptable here.
     // allow:leftmost-domain-informational
-    "Reporting-MTA: dns; " + (opts.reportingMta || from.split("@")[1] || "") + "\r\n" +
+    "Reporting-MTA: dns; " + (reportingMta || from.split("@")[1] || "") + "\r\n" +
     "Arrival-Date: " + nowIso + "\r\n" +
     "\r\n" +
     "Final-Recipient: rfc822; " + failedRecipient + "\r\n" +
     "Action: failed\r\n" +
-    "Status: " + (opts.statusCode || "5.0.0") + "\r\n" +
+    "Status: " + (statusCode || "5.0.0") + "\r\n" +
     "Diagnostic-Code: smtp; " + reason + "\r\n" +
     "\r\n" +
     "--" + boundary + "\r\n" +

package/lib/mail-srs.js

@@ -53,6 +53,7 @@
 
 var nodeCrypto    = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer    = require("./safe-buffer");
 var validateOpts  = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -193,6 +194,9 @@ function create(opts) {
   function rewrite(originalAddress, nowMs) {
     validateOpts.requireNonEmptyString(
       originalAddress, "srs.rewrite.address", SrsError, "srs/bad-address");
+    // The local-part is embedded verbatim into the SRS0 envelope address —
+    // refuse CR / LF / NUL so it can't be smuggled into a later MAIL FROM.
+    safeBuffer.assertHeaderSafe(originalAddress, "srs.rewrite.address", SrsError, "srs/bad-address");
     var at = originalAddress.lastIndexOf("@");
     if (at <= 0 || at === originalAddress.length - 1) {
       throw new SrsError("srs/bad-address",
@@ -221,6 +225,7 @@ function create(opts) {
   function srs1Rewrite(srsAddress) {
     validateOpts.requireNonEmptyString(
       srsAddress, "srs.srs1Rewrite.address", SrsError, "srs/bad-address");
+    safeBuffer.assertHeaderSafe(srsAddress, "srs.srs1Rewrite.address", SrsError, "srs/bad-address");
     var at = srsAddress.lastIndexOf("@");
     if (at <= 0 || at === srsAddress.length - 1) {
       throw new SrsError("srs/bad-address",
@@ -264,6 +269,7 @@ function create(opts) {
   function reverse(srsAddress, nowMs) {
     validateOpts.requireNonEmptyString(
       srsAddress, "srs.reverse.address", SrsError, "srs/bad-address");
+    safeBuffer.assertHeaderSafe(srsAddress, "srs.reverse.address", SrsError, "srs/bad-address");
     var at = srsAddress.lastIndexOf("@");
     if (at <= 0 || at === srsAddress.length - 1) {
       throw new SrsError("srs/bad-address",

package/lib/middleware/idempotency-key.js

@@ -45,6 +45,7 @@ var lazyRequire   = require("../lazy-require");
 var numericBounds = require("../numeric-bounds");
 var validateOpts  = require("../validate-opts");
 var safeBuffer    = require("../safe-buffer");
+var requestHelpers = require("../request-helpers");
 var safeJson      = require("../safe-json");
 var safeSql       = require("../safe-sql");
 var sql           = require("../sql");
@@ -537,6 +538,18 @@ function _validateStore(store, where) {
     where + ": store", IdempotencyError, "idempotency/bad-store", true);
 }
 
+// Bind the idempotency slot to the authenticated principal. Without it the
+// slot is keyed on the client Idempotency-Key alone, so principal B is
+// served principal A's cached response (cross-actor disclosure), or A can
+// pre-seed a key to force a 422 on B (cross-actor denial), via a shared or
+// guessed key. Mirrors b.agent.idempotency's (method, actorId, key) binding.
+// Falls back to "anon" only when no principal is resolvable — mount this
+// middleware AFTER authentication so the request carries the principal.
+function _defaultScope(req) {
+  var actor = requestHelpers.extractActorContext(req);
+  return actor && typeof actor.userId === "string" && actor.userId ? actor.userId : "anon";
+}
+
 function _fingerprintRequest(req, bodyBytes, store) {
   // Fingerprint preimage = method + path + body. Per the draft §4.3,
   // a key+body mismatch is a client-side mistake; our preimage covers
@@ -676,6 +689,13 @@ function create(opts) {
     opts.bodyFingerprint, "idempotencyKey.bodyFingerprint",
     IdempotencyError, "idempotency/bad-body-fingerprint"
   ) || null;
+  // Principal scope for the idempotency slot (see _defaultScope). Binds the
+  // cache key to the authenticated actor so one principal cannot read or
+  // 422-poison another's slot via a shared / guessed Idempotency-Key.
+  // Operators with a non-standard principal shape override via opts.scopeFn.
+  var scopeFn = validateOpts.optionalFunction(
+    opts.scopeFn, "idempotencyKey.scopeFn",
+    IdempotencyError, "idempotency/bad-scope-fn") || _defaultScope;
   // Default "deny" refuses body-bearing requests that
   // arrive with neither req._rawBody / req.body NOR an operator-
   // supplied bodyFingerprint hook. The silent-degrade-to-method+path
@@ -730,6 +750,12 @@ function create(opts) {
       return problemDetails().respond(res, bad);
     }
 
+    // Scope the store slot to the authenticated principal (length-prefixed
+    // so the scope/key boundary is unambiguous) — a shared or guessed
+    // Idempotency-Key cannot cross the actor boundary.
+    var scope = String(scopeFn(req) || "anon");
+    var scopedKey = scope.length + ":" + scope + ":" + key;
+
     var bodyBytes;
     if (bodyFingerprintFn) {
       // Operator-supplied hook — called after body-parser so req.body
@@ -801,7 +827,7 @@ function create(opts) {
     var fingerprint = _fingerprintRequest(req, bodyBytes, opts.store);
 
     var cached = null;
-    try { cached = opts.store.get(key); }
+    try { cached = opts.store.get(scopedKey); }
     catch (_storeErr) {
       // Store-read failure — emit audit + treat as miss. Idempotency is
       // a best-effort optimization; the handler runs anyway.
@@ -887,7 +913,7 @@ function create(opts) {
           } catch (_e) { /* ignore */ }
           var combined = collector.result();
           try {
-            opts.store.set(key, {
+            opts.store.set(scopedKey, {
               fingerprint: fingerprint,
               statusCode:  status,
               headers:     headerMap,

package/lib/mime-parse.js

@@ -37,6 +37,8 @@
  * mdn: 1 MiB) so this module's hot-path doesn't add its own cap.
  */
 
+var pick = require("./pick");
+
 function classifyHeaderBlock(text) {
   // RFC 5322 §2.2 — every line of a header section is either a header field
   // (`name: value`), a folding continuation (leading WSP), or the empty line
@@ -153,7 +155,7 @@ function parseContentType(value) {
       pval = rest.slice(j, endTok).trim();
       i = endTok;
     }
-    params[pname] = pval;
+    if (!pick.isPoisonedKey(pname)) params[pname] = pval;
   }
   return { type: typePart, params: params };
 }

package/lib/network-dns-resolver.js

@@ -232,6 +232,7 @@ function create(opts) {
   }
 
   var cache = new Map();                  // key → { response, parsed, ttl, expiresAt, staleUntil }
+  var inflight = new Map();               // key → Promise (single-flight: coalesce concurrent misses)
 
   // CWE-400/770. LRU eviction on insert when the cache is at
   // capacity. v8 Map preserves insertion order; oldest key is the
@@ -291,11 +292,53 @@ function create(opts) {
       return _result(hit.parsed, hit.ttl, true, false, hit.validated);
     }
 
-    // Cache miss / expired — fetch from upstream, bounded by the
-    // per-query wall-clock deadline. withTimeout rejects the await so a
-    // non-responsive / stalling endpoint can't hold the request pending
-    // forever; the default _wireLookup also tears the socket down on its
-    // own req.setTimeout so the underlying fd is released.
+    // Cache miss / expired. Single-flight: coalesce concurrent misses for the
+    // same key so N simultaneous callers trigger ONE upstream lookup instead
+    // of a thundering herd (cache stampede). The winner fills the cache; the
+    // others await it and re-derive their own verdict from the shared entry
+    // (applying their own validate gate — a non-validating fill mustn't hand a
+    // validating caller an AD=0 pass).
+    if (inflight.has(key)) {
+      try { await inflight.get(key).promise; } catch (_e) { /* winner failed — re-check cache, else fetch ourselves below */ }
+      var shared = cache.get(key);
+      if (shared && shared.expiresAt > Date.now()) {
+        if (validate && !shared.validated) {
+          throw new ResolverError("resolver/validate-failed",
+            "query: validate: true but cached response was AD=0 for " + name + "/" + qtype);
+        }
+        _touch(key, shared);
+        return _result(shared.parsed, shared.ttl, true, false, shared.validated);
+      }
+      // No fresh shared entry (winner errored / served stale) — fetch ourselves.
+    }
+
+    // Wrap the fill promise in a plain entry object so the finally-guard below
+    // compares object identity, not promise identity: if this fill errors and a
+    // follower re-registers its own fresh entry for the same key before this
+    // finally runs, the winner deletes only its OWN slot, never the follower's.
+    var entry = { promise: _fetchFill(name, qtype, key, hit, now) };
+    inflight.set(key, entry);
+    var filled;
+    try { filled = await entry.promise; }
+    finally { if (inflight.get(key) === entry) inflight.delete(key); }
+    if (filled.stale) return filled.result;
+    if (validate && !filled.validated) {
+      throw new ResolverError("resolver/validate-failed",
+        "query: validate: true but upstream returned AD=0 for " + name + "/" + qtype);
+    }
+    return _result(filled.parsed, filled.ttl, false, false, filled.validated);
+  }
+
+  // The single upstream fetch + parse + cache fill, shared by all coalesced
+  // callers. Returns { stale:false, parsed, ttl, validated } on a fresh fill,
+  // { stale:true, result } when serving stale on an upstream/parse failure, or
+  // throws on an unrecoverable error. Does NOT apply the per-caller validate
+  // gate — that stays with the caller so callers with different validate flags
+  // share one lookup.
+  async function _fetchFill(name, qtype, key, hit, now) {
+    // withTimeout rejects the await so a non-responsive / stalling endpoint
+    // can't hold the request pending forever; the default _wireLookup also
+    // tears the socket down on its own req.setTimeout so the fd is released.
     var wireResponse;
     try {
       wireResponse = await safeAsync.withTimeout(
@@ -307,7 +350,7 @@ function create(opts) {
       // Upstream failure — serve stale if we have it within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
         _safeEmit("served_stale", { name: name, qtype: qtype, reason: "upstream-failure" });
-        return _result(hit.parsed, hit.ttl, true, true, hit.validated);
+        return { stale: true, result: _result(hit.parsed, hit.ttl, true, true, hit.validated) };
       }
       throw new ResolverError("resolver/upstream-failed",
         "query: upstream lookup failed for " + name + "/" + qtype + ": " + (e && e.message || String(e)));
@@ -320,7 +363,7 @@ function create(opts) {
       // Malformed upstream response — serve stale if within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
         _safeEmit("served_stale", { name: name, qtype: qtype, reason: "parse-failed" });
-        return _result(hit.parsed, hit.ttl, true, true, hit.validated);
+        return { stale: true, result: _result(hit.parsed, hit.ttl, true, true, hit.validated) };
       }
       throw e;
     }
@@ -332,18 +375,10 @@ function create(opts) {
     }
 
     // AD bit (RFC 4035 §3.2.3) — set by upstream after chain validation.
-    // Bit 5 of byte 3 of header; parsed.flags is the full 16-bit flags
-    // field at offset 2..3. AD is bit 5 within byte 3 = bit 5 of the
-    // low byte of the 16-bit flags value.
     var ad = (parsed.flags & 0x0020) !== 0;                                                              // RFC 4035 §3.2.3 AD-bit mask within DNS header flags
-    if (validate && !ad) {
-      throw new ResolverError("resolver/validate-failed",
-        "query: validate: true but upstream returned AD=0 for " + name + "/" + qtype);
-    }
 
-    // Compute effective TTL — min across answer RRs (RFC 2181 §5.2:
-    // RRset TTL is the minimum of the included RR TTLs), then clamped
-    // to [minTtlMs, maxTtlMs] to bound any single RR's TTL from
+    // Compute effective TTL — min across answer RRs (RFC 2181 §5.2), then
+    // clamped to [minTtlMs, maxTtlMs] to bound any single RR's TTL from
     // pinning a poisoned entry past operator policy.
     var rrTtl = _minTtl(parsed.answer);
     var ttlMs = Math.max(minTtlMs, Math.min(maxTtlMs, rrTtl * C.TIME.seconds(1)));
@@ -358,7 +393,7 @@ function create(opts) {
       validated:  ad,
     });
     _safeEmit("cached", { name: name, qtype: qtype, ttlMs: ttlMs, adBit: ad });
-    return _result(parsed, ttlMs, false, false, ad);
+    return { stale: false, parsed: parsed, ttl: ttlMs, validated: ad };
   }
 
   function _result(parsed, ttlMs, fromCache, stale, validated) {

package/lib/observability-otlp-exporter.js

@@ -161,7 +161,7 @@ function _spanToOtlp(span) {
     droppedAttributesCount: span.droppedAttributesCount || 0,
     events: (span.events || []).map(function (e) {
       return {
-        name:         e.name,
+        name:         _redactWireString("otel.event.name", e.name),
         timeUnixNano: e.timeUnixNano,
         attributes:   _attrToOtlp(e.attributes),
         droppedAttributesCount: 0,
@@ -357,7 +357,7 @@ function _spanToProto(span) {
   var eventsRepeated = pb.repeatedMessage(11, span.events || [], function (e) {
     return Buffer.concat([
       pb.fixed64(1, e.timeUnixNano || 0),
-      pb.string(2, e.name || ""),
+      pb.string(2, _redactWireString("otel.event.name", e.name || "")),
       pb.repeatedMessage(3, _attrsToProto(e.attributes), _keyValueToProto),
       pb.uint32(4, 0),
     ]);