@blamejs/core 0.18.35 → 0.18.36

package/CHANGELOG.md

@@ -8,6 +8,51 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.36 (2026-08-18) — **Six constant-time comparisons told you which candidate matched, by how long they took.** A comparison that runs in constant time answers one question without leaking anything. A loop of them that stops at the first match answers a second question nobody asked: how far down the list the match was. Six places in the framework compared a presented value against a list of candidates and returned as soon as one matched, so the response time reported the match's position — which deny-list entry a certificate hit, which verifier's nonce a token carried, where in a key rotation the sender currently sits.
+
+Every one of them returned the correct answer. The defect is only in how long it took, which is why no test caught it and why the guard that replaces them is structural.
+
+**Upgrade if you use `b.crypto.isCertRevoked`, `b.webhookHmac.verify`, `b.standardWebhooks.verify`, `b.httpMessageSignature.verify`, `b.eat` nonce verification, or the DPoP nonce middleware.** No API changes, no configuration changes — the comparisons simply stop reporting position. **Added:** *b.crypto.timingSafeEqualAny(presented, candidates)* — Returns `true` when `presented` equals any entry of `candidates`, comparing against every entry whatever the outcome. The loop has no `break` and no `return` inside it, and folds each result into an accumulator rather than writing `matched || compare(...)` — that short-circuits the call away once something matches, which is the early exit wearing different syntax.
+
+A candidate that is neither a Buffer nor a string counts as a non-match rather than throwing, because a deny list assembled from operator configuration should not fail the request on one malformed row. The presented value and the array itself are entry-tier: passing the wrong shape is a caller bug that would otherwise answer `false` for every input. **Fixed:** *b.auth.totp gains a drift-window and replay suite* — Fixing the drift loop exposed that nothing tested it. TOTP had assertions elsewhere, but `driftSteps` and `lastUsedStep` appeared in none of them — so the window's width, which step `verify()` reports, and the replay guard were all unverified.
+
+The new suite pins them against RFC 6238's Appendix B vectors, driven through the verify-only SHA-1 path an operator migrating from a legacy authenticator actually uses. It asserts that every step in the window verifies and reports its OWN step rather than the current one — reporting the current step would quietly make `lastUsedStep` replay-tracking useless — that a step outside the window is refused and the same code is accepted once the window widens, that a replayed step is refused while the next step still works, and that a malformed token reads as no-match while a misconfigured verifier still throws. · *Four NIST SP 800-53 control mappings corrected* — `docs/cis-sqlite-equivalent.md` maps the framework's posture to Revision 5 and cited three enhancements that Revision 5 withdrew: `AU-8(1)` for time-source synchronisation, now `SC-45(1)`; `IA-2(11)` for step-up authentication, now `IA-2(6)`; and `CP-2(8)` for recovery objectives, now folded into `CP-2`.
+
+The fourth was a live enhancement claimed for a mechanism that does not meet it. `AU-9(1)` requires audit trails written to hardware-enforced write-once media; the framework's WORM tables are a database trigger refusing UPDATE and DELETE. That is software enforcement, and an assessor would reject the mapping. The row now cites `AU-9` and says what a deployment claiming the enhancement has to add underneath. **Security:** *Six multi-candidate comparisons no longer leak the matching candidate's position* — Each of these compared a presented value against a list and exited on the first hit:
+
+- `b.crypto.isCertRevoked` — which entry of the deny list the certificate's fingerprint matched. Its own docstring promised the opposite: "every comparison runs through `crypto.timingSafeEqual` so the answer doesn't leak which entry matched", above a loop that returned inside itself.
+- `b.eat` nonce verification — which verifier's nonce an attestation token carried, under a comment reading "Constant-time compare against each candidate".
+- The DPoP nonce middleware — whether a client presented the current or the previous nonce, which locates it in the rotation window. Its comment claimed the compare existed "so server-issued nonce probing can't narrow the rolling-pair bytes via response-timing".
+- `b.webhookHmac.verify` and `b.standardWebhooks.verify` — the position of the matching signature in a multi-signature header, which tracks the sender's key rotation.
+- `b.httpMessageSignature.verify` — the position of the matching member in a `Content-Digest` header.
+
+All six now compare against every candidate. A length mismatch still short-circuits a single comparison and still leaks nothing: the lengths involved are digest and fingerprint sizes fixed by an algorithm, not secrets. · *Two more, found by checking loop scope instead of matching text* — The six above were found by reading code. Replacing the text pattern that guarded them with one that actually resolves loop bodies — brace matching over comment-stripped source — turned up two the pattern could not have seen, because neither exits with the `return true` it was looking for:
+
+- `b.auth.password` breach checking returned on the first HaveIBeenPwned range line that matched, so the response time reported WHERE in the range the hit was. The range is public; the position narrows the SHA-1 suffix, which is precisely the half of the hash that k-anonymity exists to withhold. Every line is now compared before the verdict.
+- `b.totp.verify` returned on the first drift step that matched, reporting the clock offset between authenticator and server through timing. Every step in the window is now compared, and the earliest match still wins.
+
+Neither is guarded by a `matched === null` condition on the comparison itself — that short-circuits the call away once something matches, which is the same early exit in different syntax.
+
+`b.network.dns.dane.matchCertificate` also exits on its first match and is deliberately left alone: it compares a TLSA record published in DNS against a digest of the certificate presented in the handshake. Both operands are public, so the iteration count reveals nothing an observer could not compute, and reporting which record matched is the function's contract. **Detectors:** *A detector can pin the shapes it must NOT refuse* — A `codebase-patterns` entry may now carry `fixtures: { fires, quiet }`, and a check runs them: every listed shape must fire, every listed shape must stay quiet. Nothing enforced that before, so a pattern's precision lived in whatever its author happened to try by hand — which is one direction, against the code the pattern was written for.
+
+The entry added in this release got both directions wrong before the fixtures existed. It refused a single negated comparison (`if (!timingSafeEqual(a, b)) return false; return true;` — one comparison, no position to leak), and separately refused a `.find()` locating a record by type merely because a comparison appeared nearby. Neither shape was visible from the code the pattern was aimed at. · *The live-integration runner no longer counts a file that asserted nothing as a pass* — The runner decided a file had passed from its exit status, then printed whatever `OK — <n> checks passed` line the file happened to emit. Four of the fifty integration files never emitted one, so their column was blank and nobody could tell the difference between a file that ran its assertions and a file whose `run()` resolved before reaching them. Between them those four carry 111 checks.
+
+Exit status alone cannot answer the question: a file that stops asserting exits 0 exactly like a file that passed. The runner now requires the count line and requires it to be greater than zero — `OK — 0 checks passed` matches the old pattern while verifying nothing — and the four silent files report their counts.
+
+A static check covers the same ground during the fast gates, since the runner needs the live backends to say anything. It reads the source with comment lines blanked: a commented-out success print contains every token the check looks for, and that is the likeliest way a file goes silent, so reading raw source would pass on exactly the state being guarded against. The same blanking now backs the fuzz-harness entry-point check, where a commented-out `module.exports.fuzz` would otherwise read as a wired harness. · *A constant-time compare in a loop may not exit early* — Two checks, split by what each can actually decide.
+
+A pattern covers the loop-free shape: two comparisons in sequence, each guarding its own early exit — the DPoP current/previous nonce pair. That is a sequence of tokens, so a pattern decides it exactly.
+
+Loop membership is decided by matching braces over comment-stripped source instead, because whether a comparison sits inside a particular loop body is a question about scope. Successive attempts to answer it with a pattern flagged an ordinary one-pair verifier that merely followed an unrelated loop — a text pattern stops at a brace in the first column, and loop bodies close indented — while missing `for await`, `do…while`, and brace-less single-statement bodies. Resolving the body outright covers all of them and found the two additional leaks above.
+
+A `continue` is not an early exit for this purpose: it skips a candidate that was never eligible and the loop still runs to the end, which is what `timingSafeEqualAny` does. Counting it flagged the primitive written to fix the defect.
+
+An ordinary one-pair verifier stays quiet in both checks — one comparison has no position to report.
+
+This one is the primary guard rather than the usual second line, and the reason is worth stating: every affected site produced the correct output, so no assertion on a return value could observe the defect, and a wall-clock measurement cannot assert it reliably under a parallel test runner. The property is structural — the loop must have no exit to take — so the check is structural too, and the fix routes through a primitive that cannot be talked into returning early rather than asking each loop to be reviewed.
+
+Its scope is deliberately narrow, and the boundary is recorded in the entry itself. A comparison inside a `.some` or `.find` callback is the same defect, and the check does not claim it: deciding whether a call sits inside a particular callback is a parsing question, and every attempt to answer it with a pattern either refused working code or missed a real shape. What it does cover — a positive comparison guarding an early exit — is the shape all six of these took. **References:** [NIST SP 800-53 Rev. 5 SC-45(1) — Synchronization with Authoritative Time Source](https://csf.tools/reference/nist-sp-800-53/r5/sc/sc-45/sc-45-1/) · [NIST SP 800-53 Rev. 5 AU-9(1) — Hardware Write-once Media](https://csf.tools/reference/nist-sp-800-53/r5/au/au-9/au-9-1/) · [RFC 9449 — OAuth 2.0 Demonstrating Proof of Possession (DPoP), nonce handling](https://www.rfc-editor.org/rfc/rfc9449.html) · [RFC 9421 — HTTP Message Signatures, Content-Digest verification](https://www.rfc-editor.org/rfc/rfc9421.html)
+
 - v0.18.35 (2026-08-18) — **Thirteen character policies the guards declared and did not apply, and two content guards that could not perform the repair they promised.** A guard's profile names a policy per character class — `reject`, `strip`, `audit`, `allow`. Thirteen of those settings across `b.guardEmail`, `b.guardXml`, `b.guardMarkdown`, `b.guardJson` and `b.guardYaml` resolved to something other than what they named, because the code decided by the finding's SEVERITY rather than by the policy. Severity is fixed per class — a bidi control is `critical` however it is configured — so a severity-gated decision refuses what an operator asked to record and, in a guard whose findings never reach `critical`, lets through what they asked to reject. Both directions were live at once.
 
 Every declared character policy now resolves to the action it names, and a family-wide test asserts it for all five classes across every content guard.

package/README.md

@@ -346,7 +346,7 @@ Because when something breaks, `blame` should know exactly where it lives. We ow
 
 Every release passes a layered gate at `test/layer-0-primitives/codebase-patterns.test.js` that operates on lib/ source:
 
-- **Bug-class detectors** — raw byte / time literals, `JSON.parse` on operator input without size cap, numeric opts that silently accept `Infinity` / `NaN`, ReDoS-risky regex without length cap, hash / token compares without `timingSafeEqual`, raw `new URL` skipping the SSRF gate, `Math.random()` in security-sensitive paths, and a couple dozen others — each a bug class the framework already swept once and won't re-introduce.
+- **Bug-class detectors** — raw byte / time literals, `JSON.parse` on operator input without size cap, numeric opts that silently accept `Infinity` / `NaN`, ReDoS-risky regex without length cap, hash / token compares without `timingSafeEqual`, a constant-time compare in a loop that exits on the first match (which leaks the matching candidate's position however constant each comparison is), raw `new URL` skipping the SSRF gate, `Math.random()` in security-sensitive paths, and a couple dozen others — each a bug class the framework already swept once and won't re-introduce.
 - **Inline-shape catalog (n=1)** — every primitive that's been extracted (`validateOpts.requireNonEmptyString`, `safeAsync.makeScheduledFlush`, `dbSchema.runInTransaction`, etc.) registers the inline shape it replaced; new code that re-implements the shape fails the gate even if it's the only file matching.
 - **Cluster allowlist (n>=3)** — duplicate-block detection across files. Genuine new clusters get extracted; clusters that resist extraction (parser error class signature mismatches, framework-convention shapes, cross-domain coincidences) get an entry with a documented structural reason. No silent allowlisting.
 

package/lib/auth/password.js

@@ -460,6 +460,7 @@ function policy(opts) {
       var lines = bodyText.split(/\r?\n/);
       var goodLines = 0;
       var badLines = 0;
+      var breachedCount = null;
       for (var li = 0; li < lines.length; li++) {
         var line = lines[li].trim();
         if (line.length === 0) continue;
@@ -469,13 +470,21 @@ function policy(opts) {
         var count = parseInt(line.slice(colon + 1), 10);
         if (!isFinite(count)) { badLines += 1; continue; }
         goodLines += 1;
-        if (timingSafeEqual(Buffer.from(hashSuffix, "utf8"), Buffer.from(suffix, "utf8")) &&
-            count >= p.breachThreshold) {
-          return _fail("breached",
-            "plaintext appears in HaveIBeenPwned with count " + count +
-            " (threshold " + p.breachThreshold + ")");
+        // Compare against every line, then decide. Returning on the first match
+        // made the response time report WHERE in the range response the hit was,
+        // and the range is public — so that position narrows the suffix, which is
+        // the half of the password's SHA-1 that k-anonymity exists to keep back.
+        // The condition order matters too: `count >= threshold &&` first would
+        // skip the comparison on low-count lines and leak through that instead.
+        if (timingSafeEqual(Buffer.from(hashSuffix, "utf8"), Buffer.from(suffix, "utf8"))) {
+          if (count >= p.breachThreshold && breachedCount === null) breachedCount = count;
         }
       }
+      if (breachedCount !== null) {
+        return _fail("breached",
+          "plaintext appears in HaveIBeenPwned with count " + breachedCount +
+          " (threshold " + p.breachThreshold + ")");
+      }
       // If a hostile / poisoned mirror returned a response shaped like
       // HIBP but with mostly-unparseable counts, the original loop
       // skipped them silently and reported breachCheckCount=0 — i.e.

package/lib/crypto.js

@@ -570,6 +570,66 @@ function timingSafeEqual(a, b) {
   return nodeCrypto.timingSafeEqual(bufA, bufB);
 }
 
+/**
+ * @primitive b.crypto.timingSafeEqualAny
+ * @signature b.crypto.timingSafeEqualAny(presented, candidates)
+ * @since     0.18.36
+ * @status    stable
+ * @related   b.crypto.timingSafeEqual, b.crypto.isCertRevoked, b.crypto.spkiPinVerifier
+ *
+ * Returns `true` when `presented` equals any entry of `candidates`, comparing
+ * against EVERY entry whatever the outcome. A per-candidate compare in a loop
+ * that stops at the first match answers a second question nobody asked — how
+ * far down the list the match was — and the caller's own timing then reports
+ * it: matching the first pinned key returns sooner than matching the last, and
+ * matching nothing runs the whole list. That is a position oracle over a secret
+ * ordering, so this loop has no `break`, no `return` inside it, and folds each
+ * result into an accumulator instead.
+ *
+ * A length mismatch short-circuits a single comparison, and that leaks nothing:
+ * the lengths compared here are digest and fingerprint sizes fixed by an
+ * algorithm, not secrets. `presented` and each candidate may be a Buffer or a
+ * string; a candidate that is neither counts as a non-match rather than
+ * throwing, because a deny list assembled from operator config should not fail
+ * the request on one malformed row.
+ *
+ * Entry-tier on `presented` and on the array itself: a caller that passes the
+ * wrong shape has a bug, and the compare would otherwise silently answer
+ * `false` for every input.
+ *
+ * @example
+ *   var ok = b.crypto.timingSafeEqualAny(presentedKey, [primary, previous]);
+ *   // → true when it matches either, in the same time either way
+ */
+function timingSafeEqualAny(presented, candidates) {
+  if (!Buffer.isBuffer(presented) && typeof presented !== "string") {
+    throw new TypeError(
+      "crypto.timingSafeEqualAny: argument 'presented' must be a Buffer or " +
+      "string, got " + (presented === null ? "null" : typeof presented)
+    );
+  }
+  if (!Array.isArray(candidates)) {
+    throw new TypeError(
+      "crypto.timingSafeEqualAny: argument 'candidates' must be an array, got " +
+      (candidates === null ? "null" : typeof candidates)
+    );
+  }
+  var presentedBuf = Buffer.isBuffer(presented)
+    ? presented : Buffer.from(presented, "utf8");
+  var matched = false;
+  for (var i = 0; i < candidates.length; i += 1) {
+    var candidate = candidates[i];
+    if (!Buffer.isBuffer(candidate) && typeof candidate !== "string") continue;
+    var candidateBuf = Buffer.isBuffer(candidate)
+      ? candidate : Buffer.from(candidate, "utf8");
+    if (candidateBuf.length !== presentedBuf.length) continue;
+    // `matched ||` would short-circuit the call away once something matched,
+    // which is the early exit wearing a different syntax.
+    if (nodeCrypto.timingSafeEqual(presentedBuf, candidateBuf)) matched = true;
+  }
+  return matched;
+}
+
 // ===========================================================
 // Public API — built on core primitives
 // ===========================================================
@@ -2088,18 +2148,23 @@ function isCertRevoked(pemOrDer, denyList) {
   var fp = hashCertFingerprint(pemOrDer);
   var fpHex = Buffer.from(fp.hex, "hex");
   var fpColon = Buffer.from(fp.colon);
+  // The docstring above promises the answer does not leak which entry matched.
+  // It did: the loop returned inside itself, so a hit on the first deny-list
+  // row answered sooner than a hit on the last, and a miss ran the whole list.
+  // Split by form and route each half through timingSafeEqualAny, which has no
+  // exit to take. The two buckets are compared independently because the
+  // colon form and the hex form are different byte lengths.
+  var colonEntries = [];
+  var hexEntries = [];
   for (var i = 0; i < denyList.length; i++) {
     var entry = denyList[i];
     if (typeof entry !== "string" || entry.length === 0) continue;
-    var normalized = entry.indexOf(":") !== -1 ? entry.toUpperCase() : entry.toLowerCase();
-    var normalizedBuf = entry.indexOf(":") !== -1 ? Buffer.from(normalized) : Buffer.from(normalized, "hex");
-    var compareBuf  = entry.indexOf(":") !== -1 ? fpColon : fpHex;
-    if (normalizedBuf.length === compareBuf.length &&
-        nodeCrypto.timingSafeEqual(normalizedBuf, compareBuf)) {
-      return true;
-    }
+    if (entry.indexOf(":") !== -1) colonEntries.push(Buffer.from(entry.toUpperCase()));
+    else hexEntries.push(Buffer.from(entry.toLowerCase(), "hex"));
   }
-  return false;
+  var hitColon = timingSafeEqualAny(fpColon, colonEntries);
+  var hitHex = timingSafeEqualAny(fpHex, hexEntries);
+  return hitColon || hitHex;
 }
 
 // ---- RFC 7469 SubjectPublicKeyInfo pinning ----
@@ -2461,6 +2526,7 @@ module.exports = {
   kdf:                         kdf,
   // Comparison
   timingSafeEqual:             timingSafeEqual,
+  timingSafeEqualAny:          timingSafeEqualAny,
   // Cert fingerprint helpers
   hashCertFingerprint:         hashCertFingerprint,
   isCertRevoked:               isCertRevoked,

package/lib/eat.js

@@ -88,13 +88,17 @@ function _nonceMatches(claimValue, expected) {
   var exp = _toBuf(expected);
   if (!exp) return false;
   // eat_nonce may be a single byte string or an array of them (one per
-  // verifier). Constant-time compare against each candidate.
+  // verifier). Compare against every candidate: the loop this replaced said
+  // "constant-time compare against each candidate" and then returned on the
+  // first hit, so the time reported WHICH verifier's nonce matched — an
+  // ordering the relying party did not agree to publish.
   var candidates = Array.isArray(claimValue) ? claimValue : [claimValue];
+  var bufs = [];
   for (var i = 0; i < candidates.length; i++) {
     var c = _toBuf(candidates[i]);
-    if (c && c.length === exp.length && bCrypto.timingSafeEqual(c, exp)) return true;
+    if (c) bufs.push(c);
   }
-  return false;
+  return bCrypto.timingSafeEqualAny(exp, bufs);
 }
 
 /**

package/lib/http-message-signature.js

@@ -703,19 +703,23 @@ function verify(msg, opts) {
     // buried inside another member's value or parameters. Peer-supplied
     // sha-512 / sha-256 identifiers stay the operator's responsibility.
     var expectedDigest = contentDigest(m.body);           // "sha3-512=:<b64>:"
-    var matchedDigest  = false;
     var digestMembers  = structuredFields.splitTopLevel(presented, ",");
+    var offeredDigests = [];
     for (var di = 0; di < digestMembers.length; di++) {
       var member = digestMembers[di].trim();
       var deq = member.indexOf("=");
       if (deq < 1) continue;
       var dkv = structuredFields.parseKeyValuePiece(member);
       if (dkv.key !== "sha3-512") continue;
-      var memberCanonical = "sha3-512=" + dkv.value.trim();
-      // crypto.timingSafeEqual is the length-tolerant constant-time wrapper
-      // (returns false for unequal lengths without leaking via a length branch).
-      if (bCrypto.timingSafeEqual(memberCanonical, expectedDigest)) { matchedDigest = true; break; }
+      offeredDigests.push("sha3-512=" + dkv.value.trim());
     }
+    // Every offered member is compared. The `break` this replaced stopped at
+    // the first match, so a Content-Digest header whose first sha3-512 member
+    // matched answered sooner than one whose last did — the position of the
+    // matching member, reported by timing. timingSafeEqualAny is the
+    // length-tolerant constant-time compare (an unequal length is a non-match
+    // without a branch that leaks anything: digest lengths are fixed).
+    var matchedDigest = bCrypto.timingSafeEqualAny(expectedDigest, offeredDigests);
     if (!matchedDigest) {
       return { valid: false, reason: "content-digest-mismatch" };
     }

package/lib/middleware/dpop.js

@@ -114,12 +114,16 @@ function _nonceManager(rotateSec) {
       if (shutdown) return false;
       _maybeRotate();
       if (typeof n !== "string" || n.length === 0) return false;
-      // Constant-time compare so server-issued nonce probing can't
-      // narrow the rolling-pair bytes via response-timing — matches
-      // the timingSafeEqual discipline on the DPoP-proof nonce.
-      if (current && bCrypto.timingSafeEqual(n, current.nonce)) return true;
-      if (previous && bCrypto.timingSafeEqual(n, previous.nonce)) return true;
-      return false;
+      // Constant-time compare so server-issued nonce probing can't narrow the
+      // rolling-pair bytes via response-timing. Both halves of the pair are
+      // compared every time: returning on `current` answered a client holding
+      // the current nonce sooner than one holding the previous one, which
+      // reports where in the rotation window the caller sits — the property
+      // the comment above already claimed this had.
+      var accepted = [];
+      if (current) accepted.push(current.nonce);
+      if (previous) accepted.push(previous.nonce);
+      return bCrypto.timingSafeEqualAny(n, accepted);
     },
     // Hot-reload coexistence. Operators redeploying without
     // a clean process restart need a way to drain in-flight clients

package/lib/standard-webhooks.js

@@ -158,17 +158,19 @@ function verify(opts) {
   var toSign = id + "." + ts + "." + bodyBuf.toString("utf8");
   var expected = nodeCrypto.createHmac("sha256", opts.secret).update(toSign).digest("base64");
   // Multi-version: signature header is `v1,<sig> v2,<sig>` etc.
+  // Every v1 signature in the header is compared, with no break: stopping at
+  // the first match let the response time report the POSITION of the matching
+  // signature within a multi-version header, which is a property of the
+  // sender's key rotation and not something a verifier should hand back.
   var parts = sigHeader.split(" ");
-  var any = false;
+  var offered = [];
   for (var p = 0; p < parts.length; p += 1) {
     var pair = parts[p].split(",");
     if (pair.length !== 2) continue;
     if (pair[0] !== "v1") continue;
-    if (bCrypto.timingSafeEqual(Buffer.from(expected, "utf8"), Buffer.from(pair[1], "utf8"))) {
-      any = true;
-      break;
-    }
+    offered.push(Buffer.from(pair[1], "utf8"));
   }
+  var any = bCrypto.timingSafeEqualAny(Buffer.from(expected, "utf8"), offered);
   if (!any) {
     throw new StandardWebhooksError("standard-webhooks/bad-signature",
       "verify: no v1 signature matched");

package/lib/totp.js

@@ -282,6 +282,12 @@ function verify(secret, code, opts) {
   var userCode = String(code).replace(/[\s.\-_]/g, "").padStart(resolved.digits, "0");
   var userBuf = Buffer.from(userCode);
 
+  // Every step in the drift window is compared, even after one matches. Returning
+  // from inside the loop would make the response time report WHICH step matched,
+  // and that is the clock offset between the authenticator and the server — a
+  // value derived from the shared secret's timeline that a caller submitting
+  // codes can otherwise only guess at.
+  var matchedStep = null;
   for (var d = -resolved.driftSteps; d <= resolved.driftSteps; d++) {
     var step = currentStep + d;
     if (lastUsedStep !== null && step <= lastUsedStep) continue;     // reject replays at-or-below the last accepted step
@@ -293,11 +299,14 @@ function verify(secret, code, opts) {
     try { expected = _hotp(secret, step, resolved); }
     catch (_e) { return false; }
     var expectedBuf = Buffer.from(expected);
+    // The comparison is not guarded by `matchedStep === null` — that would
+    // short-circuit the call away once something matched, which is the early
+    // exit wearing a different syntax. The earliest match still wins.
     if (timingSafeEqual(expectedBuf, userBuf)) {
-      return step;
+      if (matchedStep === null) matchedStep = step;
     }
   }
-  return false;
+  return matchedStep === null ? false : matchedStep;
 }
 
 function uri(secret, account, opts) {

package/lib/webhook-hmac.js

@@ -197,17 +197,19 @@ function verify(opts) {
   var signed = Buffer.concat([Buffer.from(tsRaw + ".", "utf8"), bodyBuf]);
   var expected = bCrypto.hmac(secretBuf, signed, nodeAlg);
   var expectedBuf = Buffer.from(expected, "utf8");
-  var matched = false;
+  // Every offered signature is compared. The `break` this replaced ended the
+  // loop at the first match, so a header whose first signature matched
+  // answered sooner than one whose last did — the position of the sender's
+  // current key inside its rotation, reported by timing.
+  //
+  // timingSafeEqualAny applies the same length pre-check per candidate; a
+  // wrong-length candidate cannot be the digest (the hex length is fixed by
+  // the algorithm, and is not secret), so it leaks nothing.
+  var offeredBufs = [];
   for (var s = 0; s < sigs.length; s += 1) {
-    // timingSafeEqual requires equal-length inputs; a wrong-length candidate
-    // cannot be the digest (the hex length is fixed by the algorithm, and is
-    // not secret), so the length pre-check leaks nothing.
-    if (sigs[s].length === expected.length &&
-        bCrypto.timingSafeEqual(expectedBuf, Buffer.from(sigs[s], "utf8"))) {
-      matched = true;
-      break;
-    }
+    offeredBufs.push(Buffer.from(sigs[s], "utf8"));
   }
+  var matched = bCrypto.timingSafeEqualAny(expectedBuf, offeredBufs);
   if (!matched) {
     throw new WebhookHmacError("webhook-hmac/bad-signature",
       "verify: no '" + sigField + "' signature matched");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.35",
+  "version": "0.18.36",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2105a3fd-0629-4778-a83f-39c23801d347",
+  "serialNumber": "urn:uuid:f384e0aa-ad27-4c4f-a0b0-eceb0cac068e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-18T15:12:45.318Z",
+    "timestamp": "2026-08-18T23:20:05.652Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.35",
+      "bom-ref": "@blamejs/core@0.18.36",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.35",
+      "version": "0.18.36",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.35",
+      "purl": "pkg:npm/%40blamejs/core@0.18.36",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.35",
+      "ref": "@blamejs/core@0.18.36",
       "dependsOn": []
     }
   ]