@blamejs/pki 0.9.7 → 0.9.8

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.9.8 — 2026-10-27
+
+Require Node 24.22.1, which fixes the Brotli decoder memory corruption in CVE-2026-111497.
+
+### Changed
+
+- `engines.node` is `>=24.22.1`. On a lower version npm reports the mismatch as EBADENGINE, and refuses the install where engine-strict is set. Node 24.22.1 ships OpenSSL 3.5.9.
+
+### Fixed
+
+- A zstd-compressed input to `pki.tls.decompressCertificate`, or to any toolkit decompression, must be exactly one Zstandard frame, and anything else is refused with `tls/decompress-failed`. The zstd decoder in Node 24.22.1 and later decodes every concatenated frame and skips skippable frames (RFC 8878 sec. 3.1.2). An empty frame or a skippable frame of arbitrary bytes before or after the real one added no output and passed the declared-length check, so one certificate chain had unboundedly many compressed encodings. A skippable frame on its own decoded to empty output.
+
+### Security
+
+- The supported Node floor moves to 24.22.1. Node 24.22.0 and earlier bundle a Brotli decoder in which malformed input can corrupt process memory, which can crash the process and may allow code execution (CVE-2026-111497). `pki.tls` passes a peer's Brotli-compressed certificate message (RFC 8879, algorithm 2) to that decoder, and the size cap the toolkit applies to the output does not protect against a fault inside the decoder. The fix is in the Node runtime, and updating an npm package does not replace it. Node 26 releases before 26.12.1 carry the same decoder and still satisfy `>=24.22.1`, so on Node 26 run 26.12.1 or later.
+
 ## v0.9.7 — 2026-10-21
 
 Refuse a key whose private key is public wherever it appears, with no option to turn the refusal off.

package/README.md

@@ -64,7 +64,7 @@ Crypto API with its limits on streaming, opaque keys, and algorithm reach.
 npm i @blamejs/pki
 ```
 
-Requires Node.js 24.21+ and runs on the shipped runtime, with no build step and
+Requires Node.js 24.22.1+ and runs on the shipped runtime, with no build step and
 no transpilation.
 
 ```js

package/lib/guard-compress.js

@@ -27,6 +27,37 @@ var _PROBE_COMPRESS = _intrinsic.assign(_intrinsic.create(null), {
   zstd: zlib.zstdCompressSync,
 });
 
+/** @internal The byte length of the one Zstandard frame at the start of `s` (RFC 8878 sec. 3.1.1),
+ *  or -1 when `s` does not open with a complete one. A decoder that follows RFC 8878 decodes every
+ *  concatenated frame and skips skippable frames, so the consumed-length check cannot see an empty
+ *  frame or a skippable frame next to the real one; this walk is what holds zstd to one frame. Only
+ *  the frame magic 0xFD2FB528 starts a frame here, so a skippable frame anywhere is refused. */
+var _ZSTD_DID_BYTES = [0, 1, 2, 4];
+var _ZSTD_FCS_BYTES = [0, 2, 4, 8];
+function _zstdFrameLength(s) {
+  var n = _sizeOf(s);
+  if (n < 6 || s[0] !== 0x28 || s[1] !== 0xb5 || s[2] !== 0x2f || s[3] !== 0xfd) return -1;
+  var fhd = s[4];
+  if ((fhd & 0x08) !== 0) return -1;
+  var single = (fhd & 0x20) !== 0;
+  var fcs = _ZSTD_FCS_BYTES[fhd >>> 6];
+  if (fcs === 0 && single) fcs = 1;
+  var p = 5 + (single ? 0 : 1) + _ZSTD_DID_BYTES[fhd & 0x03] + fcs;
+  for (;;) {
+    if (p + 3 > n) return -1;
+    var h = s[p] | (s[p + 1] << 8) | (s[p + 2] << 16);
+    var type = (h >>> 1) & 0x03;
+    if (type === 3) return -1;
+    p += 3 + (type === 1 ? 1 : (h >>> 3));
+    if (p > n) return -1;
+    if ((h & 0x01) !== 0) break;
+  }
+  if ((fhd & 0x04) !== 0) p += 4;
+  return p > n ? -1 : p;
+}
+
+var FRAME_LENGTH = _intrinsic.assign(_intrinsic.create(null), { zstd: _zstdFrameLength });
+
 function _reportsTruncation(name) {
   var compress = _PROBE_COMPRESS[name];
   var decompress = DECOMPRESS[name];
@@ -51,7 +82,7 @@ var SAFE = _intrinsic.create(null);
 _intrinsic.forEach(_objectKeys(DECOMPRESS), function (n) { if (_reportsTruncation(n)) SAFE[n] = true; });
 
 // @enforced-by guard-shape-reinlined
-// @guard-shape \bzlib\.(inflate|brotliDecompress|zstdDecompress)Sync\b
+// @guard-shape \bzlib\.(?:inflate|inflateRaw|gunzip|unzip|brotliDecompress|zstdDecompress|createInflate|createInflateRaw|createGunzip|createUnzip|createBrotliDecompress|createZstdDecompress)(?:Sync)?\b
 // @guard-via \bguard\.compress\.bounded\s*\(
 function bounded(algorithm, stream, cap, E, codes, label) {
   var decompress = DECOMPRESS[algorithm];
@@ -65,6 +96,10 @@ function bounded(algorithm, stream, cap, E, codes, label) {
     throw new TypeError("guard.compress.bounded: cap must be a positive integer");
   }
   var what = label || "the compressed input";
+  var frameLength = FRAME_LENGTH[algorithm];
+  if (frameLength && frameLength(stream) !== _sizeOf(stream)) {
+    throw E(codes.failed, what + " is not exactly one " + algorithm + " frame");
+  }
   var res;
   try {
     res = decompress(stream, { maxOutputLength: cap, info: true });

package/lib/guard-identifier.js

@@ -101,7 +101,7 @@ function assertKnownKeys(obj, known, E, code, message) {
  * Which of the two a given name is depends on the function and the engine. A STRICT function, which
  * is every function in an ES module or a `"use strict"` file, owns neither `arguments` nor `caller`,
  * and `Function.prototype` carries both as the restricted accessors, so a chain walk finds them
- * there. On the Node 24.21.0 floor a non-strict function owns both outright. Measured before this
+ * there. On the Node 24.22.1 floor a non-strict function owns both outright. Measured before this
  * covered the inherited side: a plain strict callable descriptor was refused for `arguments` by
  * `pki.cms.sign` and `pki.cms.countersign`, while the minted floor shape passed, which is the shape
  * the vectors were written on.
@@ -372,7 +372,7 @@ function _kindMembers(v) {
 /** @internal The names a callable carries before a caller assigns a field, asked of the engine
  *  rather than listed here: a function's own names, plus `Function.prototype`'s, which is where the
  *  restricted `arguments` and `caller` accessors live. Which of them a given function makes OWN
- *  depends on the engine. Measured: on Node 24.21.0, the version `engines.node` floors at, every
+ *  depends on the engine. Measured: on Node 24.22.1, the version `engines.node` floors at, every
  *  non-strict function carries own `arguments` and `caller`; on 26.9.0 none does, for a declaration
  *  and for `new Function` alike. A list written against one of those refuses a legitimate callable
  *  descriptor on the other, and a caller's non-strict CommonJS module is where the shape comes
@@ -418,7 +418,7 @@ function isOwnMachineryName(v, k) {
   if (v === null || v === undefined) return false;
   var d = _getOwnPropertyDescriptor(v, k);
   /** @internal A DATA property, because that is what the machinery is: measured on both Node
-   *  24.21.0 and 26.9.0, every one of these names a function owns is a non-enumerable data
+   *  24.22.1 and 26.9.0, every one of these names a function owns is a non-enumerable data
    *  property. An accessor a caller installed under one of those names is therefore theirs, and it
    *  reaches the unknown-field refusal by its name rather than being exempted and ignored. Asking
    *  the descriptor rather than reading the property leaves the getter uninvoked either way. */

package/lib/guard-intrinsic.js

@@ -267,7 +267,7 @@ var _strSliceOwn = uncurry(String.prototype.slice);
  *  `String.prototype.split` is specified to look the separator's `Symbol.split` method up and call
  *  it (ES2015 21.1.3.19 step 2), so the separator's prototype chain is part of the operation and a
  *  capture of `split` does not close it. Hard rule 11 bans `split` in `lib/` for exactly that
- *  reason. MEASURED on Node 24.21, the supported runtime: a captured split with a string separator
+ *  reason. MEASURED on Node 24.22.1, the supported runtime: a captured split with a string separator
  *  DOES dispatch to an installed `String.prototype[Symbol.split]`, and that made
  *  `isBlockedIp("127.0.0.1")` answer false, so a request to loopback proceeded under
  *  `blockPrivateAddresses`. Node 26.9 fast-paths a primitive-string separator past the lookup, which

package/lib/http-transport.js

@@ -581,7 +581,7 @@ function _isBlockedIp(ip) {
     /** @internal The literal is scanned on the delimiter CHARACTER rather than split on a separator
      * string. `String.prototype.split` is specified to look the separator's `Symbol.split` method up
      * and call it, so the separator's prototype chain is part of the operation and capturing `split`
-     * does not close it; hard rule 11 bans `split` in lib/ for that reason. MEASURED on Node 24.21,
+     * does not close it; hard rule 11 bans `split` in lib/ for that reason. MEASURED on Node 24.22.1,
      * the supported runtime: a hook answering with a public address's octets made this refusal clear
      * for `127.0.0.1` and a request to loopback proceeded. */
     var o = intrinsic.splitChar(ip, 46), a = +o[0], b = +o[1], c = +o[2];

package/lib/tls-cert-compress.js

@@ -40,7 +40,7 @@
  *   all rather than faulting is dropped, because a runtime that accepts a cut
  *   frame lets a peer strip a frame's tail and have the receiver read a prefix as
  *   the whole message. A dropped algorithm is then neither compressed to nor
- *   accepted. At the Node 24.21 engine floor all three qualify; on a runtime
+ *   accepted. At the Node 24.22.1 engine floor all three qualify; on a runtime
  *   where one does not, it is dropped.
  *
  * @card

package/lib/vendor/MANIFEST.json

@@ -1,4 +1,4 @@
 {
-  "_comment": "Vendored dependencies: none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.21) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
+  "_comment": "Vendored dependencies: none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.22.1) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
   "packages": {}
 }

package/lib/vendor/README.md

@@ -6,7 +6,7 @@ nothing. This directory holds only the manifest.
 ## Native-first crypto
 
 The toolkit's cryptography runs entirely on Node's built-in `node:crypto`. The
-engine floor (Node `>=24.21`) links OpenSSL 3.5, which provides:
+engine floor (Node `>=24.22.1`) links OpenSSL 3.5, which provides:
 
 - the full classical set: RSA (PKCS#1 v1.5, PSS, OAEP), ECDSA, EdDSA
   (Ed25519/Ed448), ECDH including X25519 and X448, AES (GCM/CBC/CTR/KW), HMAC,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -51,7 +51,7 @@
     "owns-its-stack"
   ],
   "engines": {
-    "node": ">=24.21.0"
+    "node": ">=24.22.1"
   },
   "files": [
     "index.js",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1f2b6ec8-3dcd-4f4f-abc6-92aeb5ba8795",
+  "serialNumber": "urn:uuid:28a2dc7f-a34d-48fb-911a-b3c269f6e1bc",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-21T20:18:37.023Z",
+    "timestamp": "2026-10-27T17:35:33.081Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -15,18 +15,18 @@
       {
         "vendor": "npm",
         "name": "cli",
-        "version": "11.19.0"
+        "version": "11.19.1"
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.9.7",
+      "bom-ref": "@blamejs/pki@0.9.8",
       "type": "application",
       "name": "pki",
-      "version": "0.9.7",
+      "version": "0.9.8",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.9.7",
+      "purl": "pkg:npm/%40blamejs/pki@0.9.8",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.9.7",
+      "ref": "@blamejs/pki@0.9.8",
       "dependsOn": []
     }
   ]