@blamejs/core 0.16.39 → 0.17.0

package/CHANGELOG.md

@@ -6,8 +6,14 @@ Pre-1.0 the surface is intentionally evolving — every release may
 change something operators depend on. Read each entry before
 upgrading across more than a few patches at a time.
 
+## v0.17.x
+
+- v0.17.0 (2026-07-17) — **Algorithm and key-type lookups across the crypto verifiers reject a prototype-member name instead of accepting it, the ZIP reader honors the operator's decompression-ratio policy, and signed S3/GCS query parameters transmit the space encoding they were signed with.** A family of verifiers resolved an algorithm, hash, or key-type name against a plain-object lookup table with a truthiness or `in`-operator guard, so a name that is an inherited Object.prototype member (constructor, __proto__, toString, valueOf) slipped the guard and resolved to the inherited member: b.jwk thumbprinted an attacker-crafted key to a predictable digest, b.vc and b.contentCredentials emitted a real signature under a bogus algorithm, and b.sdJwtVc accepted an attacker-controlled hash name from an unsigned issuer payload. All of them now reject a name that is not an own property of the table. Separately, b.archive's ZIP reader silently capped the decompression ratio at its composed default and ignored the operator's configured bomb policy, refusing legitimate highly-compressible entries; and b.storage's SigV4 (and the GCS V4 presigner) signed a query space as %20 but transmitted it as +, so a signed parameter carrying a space was rejected as a signature mismatch. **Fixed:** *ZIP extraction honors the operator's decompression-ratio policy* — b.archive's random-access ZIP reader composed b.safeDecompress for each DEFLATE entry without forwarding the reader's own expansion-ratio cap, so the decompression inherited safeDecompress's stricter default ratio and silently overrode the operator's configured bomb policy. A ZIP entry that legitimately compressed better than the default ratio (logs, JSON, telemetry, zero-padded or sparse binaries) was refused even when the operator's policy permitted it. The reader now forwards its configured maximum expansion ratio into the decode, so the actual-bytes ratio re-check uses the same cap the declared-size gate already enforced. · *Signed S3 and GCS query parameters transmit the space encoding they were signed with* — b.storage's SigV4 request signing (S3, R2, MinIO, and the S3-compatible backends) and the GCS V4 presigner sign the canonical query string, which encodes a space as %20 per the AWS/GCS specification, but transmitted the request via the WHATWG URL serializer, which encodes a space as +. A signed query parameter carrying a literal space -- a response-content-disposition filename or a list prefix -- was therefore signed over %20 but sent as +, so the storage server re-canonicalized to different bytes and rejected the request with a signature mismatch. The signer now aligns the wire query to the signed canonical encoding (rewriting a bare + back to %20) at each signing sink, so the transmitted query is byte-identical to what the signature commits to. **Security:** *Crypto algorithm and key-type lookups reject a prototype-member name* — Several verifiers resolved a caller- or attacker-supplied algorithm / hash / key-type name against a plain-object lookup table using a truthiness check (`var v = TABLE[name]; if (!v) reject`) or the prototype-chain-aware `in` operator. A name that names an inherited Object.prototype member -- constructor, __proto__, toString, valueOf, toLocaleString -- is truthy (or present via the prototype chain), so it slipped the guard and resolved to the inherited member. The observed consequences: b.jwk.thumbprint / canonicalize accepted an unsupported kty and thumbprinted the key to a single predictable digest; b.vc.issue (JOSE) and b.contentCredentials.signCose emitted a real signature under a bogus algorithm id; and b.sdJwtVc.present accepted an attacker-controlled _sd_alg read from the unsigned issuer payload. b.tsa and the SD-JWT hash-disclosure path returned a raw runtime error rather than a typed rejection. Every one of these table lookups now checks Object.prototype.hasOwnProperty before indexing, so a name that is not an own member of the table is rejected with the primitive's typed error. Supported algorithm and key-type names are unaffected.
+
 ## v0.16.x
 
+- v0.16.40 (2026-07-16) — **Four request-path fixes: the router no longer lets the Host header steer which route runs, per-route rate limits can no longer be evaded with a rotating query string, and the message-format and URI-template expanders no longer leak inherited object properties.** b.router derived the dispatch path from the client-controlled Host header, so a path-like Host value bled into the parsed pathname and could steer a request to a different route than its request line named -- a path-ACL bypass in front-proxied deployments. b.middleware.rateLimit in per-route scope fell back to the full request URL (query string included) when the router had not populated the path, letting a rotating throwaway query parameter mint a fresh bucket per request. And b.i18n message-format and b.uriTemplate resolved a template-derived variable name with a bare property read, so a name like {toString} or {constructor} returned an inherited Object.prototype member (or a prototype-polluted value) instead of treating the variable as absent. **Security:** *The Host header can no longer influence which route is dispatched* — b.router derived the request path it matches routes against (req.pathname) by parsing the Host header concatenated with the request URL. WHATWG URL parsing folds any path-like characters in the Host value into the parsed pathname, so a request whose request line was /x but whose Host header was trusted/admin dispatched as /admin/x while req.url stayed /x. Because req.pathname is what the route matcher and every path-scoped guard (auth, CSRF, mTLS) compare against, a client could steer which handler runs -- and a front proxy or WAF that authorizes on the visible request path is bypassed. The router now derives the path and query from the request URL alone, resolved against a fixed internal authority, so the Host header cannot perturb routing; a request target that is not origin-form (a single leading slash) -- an absolute-form, authority-form, asterisk-form, or network-path-reference target -- is rejected with 400 rather than coerced into a routable path. The request's real scheme and host remain available to the consumers (canonical URL, CORS, host allowlist) that legitimately need them. · *Per-route rate limits key on the path only, not the query string* — b.middleware.rateLimit with scope: "per-route" composed its bucket key from req.pathname, falling back to the full request URL when pathname was absent (a raw Node request handed to the middleware without the router populating it). The fallback included the query string, which is not part of route identity, so an attacker could rotate a throwaway parameter (?nonce=1, ?nonce=2, ...) to mint a fresh bucket per request from the same client and evade the limit. The per-route key now strips the query in the fallback, matching the path-normalization the other request-scoped guards already apply. · *Message-format and URI-template variable lookups are own-property only* — b.i18n message-format ({arg}, {n, plural, ...}, {s, select, ...}) and b.uriTemplate ({var} expansion) resolved a variable name parsed from the template with a bare property read of the caller's variables object. A template naming an inherited member -- {toString}, {constructor}, {valueOf}, {__proto__} -- therefore returned the Object.prototype member (a function's source, or a prototype-polluted value) instead of treating the variable as absent, leaking it into rendered output or an expanded URI. Both now resolve variables through an own-property check, so an inherited or polluted name renders empty (message-format argument) or is omitted per RFC 6570 (URI template), matching the own-property discipline the HTML template engine and the simple interpolator already enforce.
+
 - v0.16.39 (2026-07-16) — **Three fixes across the outbound HTTP cache, session device binding, and XML canonicalization: a shared cache no longer serves one principal's authenticated response to another, a strict device-binding policy no longer admits an unbound session, and XML canonicalization no longer collides literal and character-reference line endings.** The RFC 9111 outbound HTTP cache (b.httpClient) leaked across principals: a shared cache (the default) stored and re-served the response to an Authorization-bearing GET to a subsequent request from a different caller, violating RFC 9111 §3.5. b.session.verify failed open under a strict device-binding policy for a session that carried no stored fingerprint -- the normal state for any session created without a request context, including API-token, OAuth-callback, and admin-created flows -- so requireFingerprintMatch / maxAnomalyScore silently admitted a session from any device. And b.xmlC14n canonicalized a literal TAB / CR / LF and the equivalent character reference to identical bytes, a distinct-input / identical-output collision in the exact primitive whose purpose is preventing XML-signature-wrapping, affecting the attribute values and the element text and CDATA that XMLDSig signatures cover. **Security:** *Shared HTTP cache no longer serves an authenticated response across principals* — b.httpClient's RFC 9111 response cache, in shared mode (the default), stored and re-served the response to a GET carrying an Authorization header to a later request from a different principal. RFC 9111 §3.5 forbids a shared cache from reusing a stored response to an Authorization-bearing request unless the response opts in via public, s-maxage, or must-revalidate; the storage decision never inspected the request headers, so an authenticated per-user response with an ordinary max-age was cached and served to other users. The storage decision now refuses to persist an Authorization-bearing request's response in a shared cache unless the origin supplies one of those opt-ins. Private caches (sharedCache: false) and the opt-in directives are unaffected. · *Strict session device binding refuses an unbound session instead of admitting it* — b.session.verify treats requireFingerprintMatch: true or a maxAnomalyScore threshold as a per-request assertion that the session is device-bound and the current device matches. Those refusals were reached only when a stored fingerprint was present, so a session with no binding -- the state of any session created without a request context (API-token, OAuth-callback, admin-created, and 'remember me' flows) -- skipped the strict gate entirely and was admitted from any device. verify now fails closed (returns null, audit event auth.session.binding_missing) whenever a strict binding policy is requested but the session carries no comparable fingerprint, covering both a never-bound session and one whose sealed binding cannot be decrypted. Bind any session you intend to verify strictly by passing the request context to create(); verifications that do not request a strict policy are unchanged. · *XML canonicalization distinguishes literal whitespace from character references* — b.xmlC14n produces the canonical byte form that XML signatures cover, so distinct inputs must yield distinct bytes or a signed document can be swapped for a different one whose canonical form still matches (signature wrapping). A literal TAB, CR, or LF and the equivalent character reference (	 / 
 / 
) canonicalized to identical bytes: attribute values were not normalized per XML 1.0 §3.3.3, and character data (element text and CDATA) was not line-ending-normalized per §2.11. Attribute-value whitespace now folds to a single space while character-reference whitespace is preserved, and literal CR / CRLF in character data now folds to a single LF while a 
 reference is preserved -- so a literal control character and its character-reference form canonicalize distinctly everywhere a signature covers. The SAML XMLDSig verification and b.guardXml signature-wrapping defense that consume the canonical form inherit the fix.
 
 - v0.16.38 (2026-07-16) — **Three fixes to data-subject scoping, break-glass grant limits, and idempotent-retry replay: a data-subject filter no longer matches every subject when it has no indexable key, a single-row break-glass grant can no longer be spent twice concurrently, and an idempotent retry returns its cached result under a vault.** b.dsr's subject-scoped ticket filter failed open: a subject carrying none of the indexable keys (email / subjectId) -- a phone-only, alias-only, or empty subject -- matched EVERY ticket instead of none, so listBySubject returned other subjects' tickets and the erasure-completion purge deleted them. Both ticket stores now fail closed. b.breakGlass's per-row grant limit could be exceeded under concurrency: two simultaneous unseals of a one-row grant against different rows both succeeded, because the claim was decided from a re-read of the shared counter that already reflected the other caller's increment; the claim is now decided from the atomic update's affected-row count. And b.agent.idempotency's putIfAbsent replay parsed the sealed result blob without unsealing it, so under a vault (the production default) every idempotent retry that landed on a completed key threw instead of returning the cached result -- and get() on a pending claim threw on a null result blob rather than reporting no cached result. **Fixed:** *Data-subject request filter fails closed when a subject has no indexable key* — b.dsr's subject-scoped ticket filter matched on the indexable keys email and subjectId. When the supplied subject carried neither -- a phone-only subject (a legitimate SMS-first identity), an alias-only subject, or an empty object -- the filter added no predicate and returned every ticket in the store instead of none. Through the exported API this meant listBySubject(subject) disclosed every subject's tickets, and the erasure-completion purge (which lists a subject's other tickets and deletes them) deleted every other subject's tickets. Both the in-memory and database ticket stores now fail closed: a subject filter that produces no usable predicate matches nothing, so an unindexable subject can neither read nor delete another subject's data. Filters that supply an indexable key are unchanged. · *A single-row break-glass grant can no longer be spent twice under concurrency* — b.breakGlass.unsealRow enforces a per-grant row limit with an atomic compare-and-increment (update the consumed counter where it is still below the cap). It then decided whether the caller won the slot by re-reading the counter and comparing it to the caller's own stale pre-value -- but a concurrent winner's increment is visible to the loser's re-read, so both callers saw a change and both proceeded, unsealing two rows under a one-row grant. The claim is now decided from the atomic update's affected-row count: exactly one caller's compare-and-increment modifies the row, and the loser (zero rows modified) is refused with grant-exhausted. The re-read is retained only for the audit's remaining-rows hint. · *Idempotent retries return their cached result under a vault, and a pending-claim read reports absent* — b.agent.idempotency seals the cached result at rest via b.cryptoField when a vault is configured (the production default). putIfAbsent's replay branch parsed the stored result blob as JSON without unsealing it first, so a retry that landed on an already-completed key threw a corrupt-result error instead of returning the cached result -- breaking the primitive's exactly-once replay guarantee exactly where operators run it. It now unseals before parsing, mirroring get(). Separately, get() on a pending claim (whose result blob is null because no result has been written yet) fed null to the JSON parser and threw the same corrupt-result error; it now reports no cached result, so a concurrent status check during another worker's in-flight claim no longer throws.

package/lib/archive-read.js

@@ -606,6 +606,14 @@ async function _decompressEntry(adapter, entry, dataStart, bombPolicy) {
       algorithm:          "deflate-raw",
       maxOutputBytes:     maxOutput,
       maxCompressedBytes: entry.compressedSize,
+      // Honor the reader's own expansion-ratio cap. Without this, the
+      // composition inherits safeDecompress's DEFAULT_MAX_RATIO (50),
+      // which silently overrides bombPolicy.maxExpansionRatio and refuses
+      // every entry compressing better than 50:1 even when the operator's
+      // policy (default 100) permits it. The declared-size ratio was
+      // already validated in _enforceBombPolicy; this re-check on the
+      // actual inflated bytes uses the SAME configured cap.
+      maxRatio:           bombPolicy.maxExpansionRatio,
     });
     if (decompressed.length !== entry.uncompressedSize) {
       throw new ArchiveReadError("archive-read/inflate-size-mismatch",

package/lib/auth/sd-jwt-vc.js

@@ -119,11 +119,11 @@ function _b64uDecodeBuf(s) {
 }
 
 function _hashDisclosure(disclosureStr, hashAlg) {
-  var nodeAlg = SUPPORTED_HASH_ALGS[hashAlg];
-  if (!nodeAlg) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "Unsupported hash algorithm: " + hashAlg);
   }
+  var nodeAlg = SUPPORTED_HASH_ALGS[hashAlg];
   var h = nodeCrypto.createHash(nodeAlg);
   h.update(disclosureStr, "ascii");
   return h.digest().toString("base64url");
@@ -338,12 +338,12 @@ function present(opts) {
   }
   var _sdAlg = (_issuerPayload && typeof _issuerPayload._sd_alg === "string")
     ? _issuerPayload._sd_alg : "sha-256";
-  var _sdNodeHash = SUPPORTED_HASH_ALGS[_sdAlg];
-  if (!_sdNodeHash) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, _sdAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "present: issuer credential declares _sd_alg \"" + _sdAlg +
       "\" which this framework version does not support");
   }
+  var _sdNodeHash = SUPPORTED_HASH_ALGS[_sdAlg];
 
   var disclosedNames = Array.isArray(opts.disclosedClaimNames)
     ? opts.disclosedClaimNames.slice() : [];

package/lib/content-credentials.js

@@ -595,7 +595,7 @@ function signCose(manifest, opts) {
   validateOpts.requireNonEmptyString(opts.privateKeyPem,
     "contentCredentials.signCose: privateKeyPem", ContentCredentialsError, "BAD_KEY");
   var algName = (opts.alg || "ml-dsa-87").toLowerCase();
-  if (!(algName in COSE_ALGS)) {
+  if (!Object.prototype.hasOwnProperty.call(COSE_ALGS, algName)) {
     throw ContentCredentialsError.factory("content-credentials/bad-alg",
       "contentCredentials.signCose: alg '" + algName +
       "' not in COSE alg registry. Known: " + Object.keys(COSE_ALGS).join(", "));

package/lib/i18n-messageformat.js

@@ -373,17 +373,30 @@ function _ownCase(cases, key) {
   return Object.prototype.hasOwnProperty.call(cases, key) ? cases[key] : undefined;
 }
 
+// Own-property variable lookup. A template argument NAME is parse-derived from
+// the (possibly operator/tenant-supplied) message, so it can be `toString` /
+// `constructor` / `valueOf` / `__proto__` / any prototype-polluted key. A bare
+// `vars[name]` would then return the INHERITED Object.prototype member instead
+// of treating the variable as absent — leaking a function source (or a planted
+// prototype value) into rendered output and diverging from both the "missing
+// arg renders empty" contract and the sibling simple interpolator in b.i18n,
+// which is already own-property-only. Every argument / plural / select value
+// lookup goes through this so no template name can reach the prototype chain.
+function _ownVar(vars, name) {
+  return Object.prototype.hasOwnProperty.call(vars, name) ? vars[name] : undefined;
+}
+
 function _renderNode(node, vars, locale, hashContext, depth) {
   if (node.type === "literal") return node.value;
   if (node.type === "hash") {
     return hashContext != null ? String(hashContext) : "#";
   }
   if (node.type === "argument") {
-    var v = vars[node.name];
+    var v = _ownVar(vars, node.name);
     return v === undefined ? "" : (v === null ? "" : String(v));
   }
   if (node.type === "plural" || node.type === "ordinal") {
-    var raw = vars[node.name];
+    var raw = _ownVar(vars, node.name);
     var n = Number(raw);
     if (!Number.isFinite(n)) {
       throw _err("BAD_VAR",
@@ -401,7 +414,7 @@ function _renderNode(node, vars, locale, hashContext, depth) {
     return _renderSequence(caseBody, vars, locale, adjusted, depth + 1);
   }
   if (node.type === "select") {
-    var sv = vars[node.name];
+    var sv = _ownVar(vars, node.name);
     var key = (sv === undefined || sv === null) ? "other" : String(sv);
     var body = _ownCase(node.cases, key) || _ownCase(node.cases, "other");
     return _renderSequence(body, vars, locale, hashContext, depth + 1);

package/lib/jwk.js

@@ -58,8 +58,17 @@ function _requiredMembers(jwk) {
   if (typeof jwk.kty !== "string" || jwk.kty.length === 0) {
     throw new JwkError("jwk/bad-jwk", "jwk: 'kty' is required");
   }
+  // Own-property lookup only: `kty` is attacker-controlled, and a plain-object
+  // bracket read resolves inherited Object.prototype members (`__proto__`,
+  // `toString`, `valueOf`, `toLocaleString`, …). Those are truthy, so an
+  // unguarded `if (!names)` would treat them as supported key types — the
+  // zero-`length` prototype methods then iterate no required members and
+  // thumbprint the empty object, collapsing distinct inputs onto one
+  // predictable digest instead of the intended unsupported-kty refusal.
+  if (!Object.prototype.hasOwnProperty.call(REQUIRED, jwk.kty)) {
+    throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
+  }
   var names = REQUIRED[jwk.kty];
-  if (!names) throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
   var out = {};
   for (var i = 0; i < names.length; i++) {
     var n = names[i];
@@ -115,8 +124,16 @@ function canonicalize(jwk) {
  */
 function thumbprint(jwk, opts) {
   opts = opts || {};
-  var hash = HASHES[opts.hash || "sha256"];
-  if (!hash) throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  // Own-property lookup only — `opts.hash` is caller-controlled; a bare
+  // bracket read of the HASHES table resolves inherited members (`toString`,
+  // `constructor`, …) to truthy functions that slip past `!hash` and reach
+  // createHash as a non-string, leaking a raw ERR_INVALID_ARG_TYPE instead of
+  // the typed jwk/bad-hash refusal the primitive documents.
+  var hashName = opts.hash || "sha256";
+  if (!Object.prototype.hasOwnProperty.call(HASHES, hashName)) {
+    throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  }
+  var hash = HASHES[hashName];
   var canon = canonicalize(jwk);
   return nodeCrypto.createHash(hash).update(canon, "utf8").digest("base64url");
 }

package/lib/middleware/rate-limit.js

@@ -570,7 +570,18 @@ function create(opts) {
   var middleware = function rateLimit(req, res, next) {
     if (_shouldSkip(req)) return next();
     var k = keyFn(req);
-    if (scope === "per-route") k = (req.method || "GET") + ":" + (req.pathname || req.url || "/") + "|" + k;
+    // Per-route scope keys on the route PATH only — never the query string. The
+    // query is not part of route identity; keying on it lets an attacker rotate
+    // a throwaway param (?nonce=N) to mint a fresh per-route bucket per request
+    // and evade the limit. req.pathname (set query-free by b.router) is
+    // preferred; when it is absent (a raw Node req handed to the middleware
+    // directly) fall back to req.url with the query stripped — the same strip
+    // every sibling guard (request-log / require-auth / network-allowlist)
+    // already applies.
+    if (scope === "per-route") {
+      var routePath = req.pathname || (req.url || "/").split("?")[0] || "/";
+      k = (req.method || "GET") + ":" + routePath + "|" + k;
+    }
 
     function _handle(verdict) {
       if (emitHeaders && typeof res.setHeader === "function") {

package/lib/object-store/gcs.js

@@ -362,6 +362,13 @@ function create(config) {
 
     url.searchParams.set("X-Goog-Signature", signature);
 
+    // Final query mutation done — align the wire space encoding to the signed
+    // canonical query (GCS V4 signs "%20" but url.toString() would serialize a
+    // space as "+", so a spaced response-header override / prefix would be
+    // rejected as a signature mismatch). Must precede url.toString(); do not
+    // touch url.searchParams afterward (it re-serializes spaces back to "+").
+    sigv4.alignWireQueryToSigV4(url);
+
     var clientHeaders = {};
     if (opts.contentType) clientHeaders["Content-Type"] = opts.contentType;
 

package/lib/object-store/sigv4.js

@@ -120,6 +120,29 @@ function canonicalQueryString(searchParams) {
   }).join("&");
 }
 
+// Reconcile the wire query with the signed canonical query. The WHATWG URL
+// serializes its query via application/x-www-form-urlencoded, which encodes a
+// space as "+"; SigV4 signs canonicalQueryString, which encodes a space as
+// "%20" (AWS: "encode the space character as %20 and not +"). Left
+// unreconciled, a signed query parameter carrying a literal space (a
+// response-content-disposition filename, a list prefix) is transmitted
+// (url.search / url.toString) as "+" while the signature commits to "%20", so
+// the server re-canonicalizes to different bytes and rejects the request with
+// SignatureDoesNotMatch. A bare "+" in url.search is ALWAYS an encoded space —
+// URLSearchParams serializes a literal "+" as "%2B" and parses "+" back to a
+// space, so canonicalQueryString already signed that position as "%20";
+// rewriting "+" to "%20" makes the transmitted query byte-identical to the
+// signed canonical query. Bare subresource tokens (?uploads / ?lifecycle) carry
+// no "+", so they pass through untouched. Mutates url.search in place (the
+// string setter preserves "%20"); callers MUST NOT touch url.searchParams
+// afterward — that re-serializes spaces back to "+".
+function _alignWireQueryToSigV4(url) {
+  var search = url.search;
+  if (search.indexOf("+") !== -1) {
+    url.search = search.replace(/\+/g, "%20");   // allow:regex-no-length-cap — single-char global replace, input bounded by maxUrlLength
+  }
+}
+
 function canonicalHeaders(headers) {
   var pairs = [];
   for (var k in headers) {
@@ -233,6 +256,10 @@ function signRequest(opts) {
     ", Signature=" + signature;
   headers["Authorization"] = auth;
 
+  // The URL just signed is the one the caller transmits — make its wire query
+  // byte-identical to the canonical query the signature commits to.
+  _alignWireQueryToSigV4(url);
+
   return { headers: headers, signature: signature, canonicalRequest: canon, stringToSign: sts };
 }
 
@@ -810,6 +837,9 @@ function create(config) {
     var signature = nodeCrypto.createHmac("sha256", signingKey).update(sts).digest("hex");
 
     url.searchParams.set("X-Amz-Signature", signature);
+    // Final query mutation done — align the wire space encoding to the signed
+    // "%20" form before serializing the URL the client will use.
+    _alignWireQueryToSigV4(url);
 
     var clientHeaders = {};
     if (opts.contentType) clientHeaders["Content-Type"] = opts.contentType;
@@ -994,6 +1024,7 @@ module.exports = {
   deriveSigningKey:     deriveSigningKey,
   canonicalQueryString: canonicalQueryString,
   canonicalHeaders:     canonicalHeaders,
+  alignWireQueryToSigV4: _alignWireQueryToSigV4,
   awsUriEncode:         awsUriEncode,
   sha256Hex:            sha256Hex,
   formatAmzDate:        _formatAmzDate,

package/lib/router.js

@@ -298,6 +298,18 @@ function compilePattern(pattern) {
 // object on match, null otherwise. Single non-empty trailing slash
 // difference is treated as a no-match (callers that want trailing-slash
 // tolerance normalize the path before dispatch).
+// Collapse a leading run of slashes in a request target to a single "/" so a
+// `//host/path` network-path reference becomes a plain path. Shared by handle()
+// (routing + the value written back onto req.url) and _check0RttReplay (the
+// early-data replay key) so both derive from ONE canonical target: otherwise
+// `//x`, `///x`, and `/x` route to the same endpoint but would each mint a
+// distinct replay-cache key, letting an attacker replay Early-Data by varying
+// the leading-slash run.
+function _canonicalRequestTarget(url) {
+  var t = String(url == null ? "/" : url);
+  return t.charAt(0) === "/" && t.charAt(1) === "/" ? t.replace(/^\/+/, "/") : t;
+}
+
 function _matchCompiled(compiled, pathname) {
   var pathSegments = pathname.split("/");
   var patSegments = compiled.segments;
@@ -747,11 +759,50 @@ class Router {
   }
 
   async handle(req, res) {
-    // Compose an absolute URL from the request's path + Host header so
-    // safeUrl.parse can validate the protocol + length. The "http://"
-    // base is the relative-resolution origin; the request's actual
-    // scheme lives in requestHelpers.requestProtocol elsewhere.
-    var absolute = "http://" + (req.headers.host || "localhost") + (req.url || "/");
+    // Derive the request path + query from req.url ALONE, resolved against a
+    // FIXED internal authority — the Host header must NEVER influence which
+    // route is dispatched. Host is client-controlled: a value like
+    // "trusted/admin" bleeds its path segment into WHATWG-URL's pathname
+    // parsing (a leading "/admin" prepended), so a request whose request-line
+    // is "/x" would route as "/admin/x" while req.url stays "/x". That
+    // desyncs req.pathname (the value the route matcher AND every path-scoped
+    // guard compare against) from req.url, and a front proxy that ACLs on the
+    // visible request path is bypassed — the proxy sees "/x", the origin
+    // dispatches "/admin/x". Parsing req.url against a constant base keeps
+    // req.pathname a pure function of the request target. The request's real
+    // scheme + host live on req.headers.host / requestHelpers.requestProtocol
+    // for the consumers (canonical-URL, CORS, host-allowlist) that need them.
+    var reqTarget = req.url || "/";
+    // Only an origin-form request target — beginning with "/" (RFC 9112
+    // §3.2.1) — is routable by a path router. Reject an absolute-form
+    // (`http://host/path`), authority-form (`host:port`), or asterisk-form
+    // (`OPTIONS *`) target with 400 rather than coercing it into a routable
+    // path by prefixing: prefixing would turn `http://evil/admin` into
+    // `/http://evil/admin`, which a `/:x` or catch-all route would still match
+    // — the opposite of failing closed. A "/"-leading target (including one
+    // with a redundant leading slash like `//x`, a valid absolute-path with an
+    // empty first segment) is safe: parsed against the fixed authority it
+    // becomes a pathname, never a host, so the Host header still cannot steer
+    // routing.
+    if (reqTarget.charAt(0) !== "/") {
+      res.statusCode = 400;
+      res.end("400 Bad Request: non-origin-form request target");
+      return;
+    }
+    // Collapse a leading run of slashes to a single "/". A `//host/path` target
+    // is a valid absolute-path (empty first segment) so it need not be refused,
+    // but left intact it stays a network-path reference: any consumer that
+    // resolves req.url as a URL reference (`new URL(req.url, base)`) would read
+    // the first segment as an AUTHORITY — a Host bleed / SSRF. Normalizing here
+    // (via the same canonical-target helper the 0-RTT replay key uses), and
+    // writing the result back onto req.url, keeps it a pure path for the route
+    // matcher AND every downstream req.url reader.
+    var canonicalTarget = _canonicalRequestTarget(reqTarget);
+    if (canonicalTarget !== reqTarget) {
+      reqTarget = canonicalTarget;
+      req.url = reqTarget;
+    }
+    var absolute = "http://blamejs.invalid" + reqTarget;
     var parsed = safeUrl.parse(absolute, {
       allowedProtocols: safeUrl.ALLOW_HTTP_ALL,
     });
@@ -930,7 +981,10 @@ class Router {
     this._reap0RttCache(nowMs);
     var hash = require("node:crypto").createHash("sha3-512");
     hash.update(String(req.method || "") + "\n");
-    hash.update(String(req.url || "") + "\n");
+    // Canonical target — collapse a leading slash run so `//x` and `/x`, which
+    // dispatch to the same route, share one replay key (varying the leading
+    // slashes must not mint a fresh key and defeat the replay window).
+    hash.update(_canonicalRequestTarget(req.url) + "\n");
     hash.update(String((req.headers && req.headers["host"]) || "") + "\n");
     hash.update(String((req.headers && req.headers["authorization"]) || "") + "\n");
     hash.update(String((req.headers && req.headers["date"]) || "") + "\n");

package/lib/tsa.js

@@ -122,11 +122,11 @@ function _normHex(h) {
 // Resolve the message imprint: hash the data, or use a pre-computed hash.
 function _imprint(data, opts, fnName) {
   var hashName = opts.hashAlg || "SHA-512";
-  var h = IMPRINT_HASHES[hashName];
-  if (!h) {
+  if (!Object.prototype.hasOwnProperty.call(IMPRINT_HASHES, hashName)) {
     throw new TsaError("tsa/bad-hash-alg",
       fnName + ": hashAlg must be one of " + Object.keys(IMPRINT_HASHES).join(" / "));
   }
+  var h = IMPRINT_HASHES[hashName];
   var digest;
   if (opts.hashed) {
     digest = _bytes(data, "hash");

package/lib/uri-template.js

@@ -159,7 +159,14 @@ function _expandExpr(expr, vars) {
   var o = OPERATORS[expr.op];
   var pieces = [];
   expr.specs.forEach(function (spec) {
-    var value = vars[spec.name];
+    // Own-property only: a varspec name is parse-derived from the template, so
+    // it can be `constructor` / `toString` / `__proto__` / any prototype-
+    // polluted key. A bare `vars[spec.name]` would read the INHERITED member
+    // and expand a function source (or a planted prototype value) into the URI.
+    // RFC 6570 §3.2.1 treats an undefined variable as omitted, so an inherited
+    // name must be undefined here — never a prototype-chain read.
+    var value = Object.prototype.hasOwnProperty.call(vars, spec.name)
+      ? vars[spec.name] : undefined;
     if (!_isDefined(value)) return;
 
     if (typeof value !== "object") {

package/lib/vc.js

@@ -247,10 +247,10 @@ function _sign(doc, opts, joseTyp, coseTyp, coseContentType, fnName) {
     });
   }
   if (opts.securing === "jose") {
-    var params = JOSE_ALGS[opts.alg];
-    if (!params) {
+    if (!Object.prototype.hasOwnProperty.call(JOSE_ALGS, opts.alg)) {
       throw new VcError("vc/bad-alg", fnName + ": JOSE securing requires alg ES256/384/512 or EdDSA (got " + opts.alg + ")");
     }
+    var params = JOSE_ALGS[opts.alg];
     var key = _toKey(opts.privateKey, "private");
     var header = { alg: opts.alg, typ: joseTyp };
     if (typeof opts.kid === "string") header.kid = opts.kid;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.39",
+  "version": "0.17.0",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ebd78666-3b8e-4324-8760-e49b09c58af5",
+  "serialNumber": "urn:uuid:cbebf8cd-986b-48a0-823b-7bd7981981bf",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T00:12:36.718Z",
+    "timestamp": "2026-07-17T06:14:29.525Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.39",
+      "bom-ref": "@blamejs/core@0.17.0",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.39",
+      "version": "0.17.0",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.39",
+      "purl": "pkg:npm/%40blamejs/core@0.17.0",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.39",
+      "ref": "@blamejs/core@0.17.0",
       "dependsOn": []
     }
   ]