@blamejs/pki 0.9.7 → 0.9.9

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.9.9 — 2026-10-27
+
+Refuse an IPv4 address spelled as a host name wherever a certificate identity is matched, whatever the Node version.
+
+### Changed
+
+- A reference identity such as `999.999.999.999`, which is neither an address nor a domain name, is refused with `identity/bad-reference` instead of being compared against dNSName entries.
+
+### Security
+
+- `pki.identity.match` refuses a reference identity whose last label is a number, or `0x` followed by hex digits, with `identity/bad-reference`, as a string and as the value of a `dns`, `srv` or `uri` record. Before, `0127.0.0.1`, `0177.0.0.1` and `0x7f.0.0.1` were matched by the dNSName `*.0.0.1`, `127.0.0.1.` by `127.0.0.1`, and `127.1` by `*.1`, and a `dns` record carrying the canonical `127.0.0.1` was matched by the dNSName `127.0.0.1`. An address is passed as the canonical dotted quad or as octets, which is compared only against `iPAddress` entries. A domain reference must also be made of letters, digits, hyphens, dots and underscores, so `127.0.0.%31` (which WHATWG URL decodes to 127.0.0.1), `::1` and `[::1]` are refused rather than compared against dNSName entries.
+- `pki.path.validate` refuses such an `opts.identity` with `path/bad-input`. Before, a leaf whose only subject alternative name was the dNSName `*.0.0.1` validated for identity `0x7f.0.0.1` under an excluded `iPAddress` subtree of 127.0.0.0/8, because the subtree applies only to `iPAddress` entries.
+- `pki.transport.https` and `pki.transport.peerChain`, and every client built on them, refuse a `tls.servername` that is such a value with `transport/bad-input`, and a `proxy.tls.servername` with `transport/bad-proxy`. A servername holding any character other than a letter, digit, hyphen, dot or underscore, including a fullwidth digit, a NUL, a percent escape or a bracketed IPv6 address, is refused the same way; a canonical address literal is still accepted. Node below 24.22.1 matched `0x7f.0.0.1` or `127` written in fullwidth digits against the dNSName `127.0.0.1`.
+- The ACME verbs refuse such a value as a `dns` identifier with `acme/bad-identifier`, in an authorization, an order, the subject `commonName` of a finalize CSR and `pki.acme.verifyTlsAlpn01`, so a finalize CSR naming one in a dNSName matches no order identifier. An address takes the `ip` identifier type (RFC 8738 sec. 3); as a `dns` identifier, a validation certificate's dNSName would prove it.
+- A URI name constraint, and the presented host of a uniformResourceIdentifier name, no longer read a host such as `0x7f.0.0.1` as a domain name. A constraint base of that form is refused as an address.
+
+## v0.9.8 — 2026-10-27
+
+Require Node 24.22.1, which fixes the Brotli decoder memory corruption in CVE-2026-111497.
+
+### Changed
+
+- `engines.node` is `>=24.22.1`. On a lower version npm reports the mismatch as EBADENGINE, and refuses the install where engine-strict is set. Node 24.22.1 ships OpenSSL 3.5.9.
+
+### Fixed
+
+- A zstd-compressed input to `pki.tls.decompressCertificate`, or to any toolkit decompression, must be exactly one Zstandard frame, and anything else is refused with `tls/decompress-failed`. The zstd decoder in Node 24.22.1 and later decodes every concatenated frame and skips skippable frames (RFC 8878 sec. 3.1.2). An empty frame or a skippable frame of arbitrary bytes before or after the real one added no output and passed the declared-length check, so one certificate chain had unboundedly many compressed encodings. A skippable frame on its own decoded to empty output.
+
+### Security
+
+- The supported Node floor moves to 24.22.1. Node 24.22.0 and earlier bundle a Brotli decoder in which malformed input can corrupt process memory, which can crash the process and may allow code execution (CVE-2026-111497). `pki.tls` passes a peer's Brotli-compressed certificate message (RFC 8879, algorithm 2) to that decoder, and the size cap the toolkit applies to the output does not protect against a fault inside the decoder. The fix is in the Node runtime, and updating an npm package does not replace it. Node 26 releases before 26.12.1 carry the same decoder and still satisfy `>=24.22.1`, so on Node 26 run 26.12.1 or later.
+
 ## v0.9.7 — 2026-10-21
 
 Refuse a key whose private key is public wherever it appears, with no option to turn the refusal off.

package/README.md

@@ -64,7 +64,7 @@ Crypto API with its limits on streaming, opaque keys, and algorithm reach.
 npm i @blamejs/pki
 ```
 
-Requires Node.js 24.21+ and runs on the shipped runtime, with no build step and
+Requires Node.js 24.22.1+ and runs on the shipped runtime, with no build step and
 no transpilation.
 
 ```js

package/lib/acme.js

@@ -456,6 +456,13 @@ function _assertDnsName(name) {
     if (!_isLdhLabel(l)) throw E("acme/bad-identifier", "a dns label must be lowercase LDH ASCII (A-label): " + JSON.stringify(l));
     if (l.indexOf("xn--") === 0 && !_isXnLabel(l)) throw E("acme/bad-identifier", "a malformed xn-- A-label: " + JSON.stringify(l));
   }
+  /** @internal A resolver and WHATWG URL read a name whose last label is a number as IPv4, so
+   *  `127.0.0.1`, `0x7f.0.0.1` and `127.1` are addresses rather than domain names. An address takes the
+   *  `ip` identifier type (RFC 8738 sec. 3); as a `dns` identifier, a dNSName SAN would prove it. */
+  if (ipUtils.endsInANumber(name)) {
+    throw E("acme/bad-identifier", "a dns identifier value is read as an IPv4 address by a resolver and by WHATWG URL; " +
+      "an address uses the ip identifier type (RFC 8738 sec. 3): " + _stringify(name));
+  }
 }
 
 function _assertIpAddress(value) {

package/lib/guard-compress.js

@@ -27,6 +27,37 @@ var _PROBE_COMPRESS = _intrinsic.assign(_intrinsic.create(null), {
   zstd: zlib.zstdCompressSync,
 });
 
+/** @internal The byte length of the one Zstandard frame at the start of `s` (RFC 8878 sec. 3.1.1),
+ *  or -1 when `s` does not open with a complete one. A decoder that follows RFC 8878 decodes every
+ *  concatenated frame and skips skippable frames, so the consumed-length check cannot see an empty
+ *  frame or a skippable frame next to the real one; this walk is what holds zstd to one frame. Only
+ *  the frame magic 0xFD2FB528 starts a frame here, so a skippable frame anywhere is refused. */
+var _ZSTD_DID_BYTES = [0, 1, 2, 4];
+var _ZSTD_FCS_BYTES = [0, 2, 4, 8];
+function _zstdFrameLength(s) {
+  var n = _sizeOf(s);
+  if (n < 6 || s[0] !== 0x28 || s[1] !== 0xb5 || s[2] !== 0x2f || s[3] !== 0xfd) return -1;
+  var fhd = s[4];
+  if ((fhd & 0x08) !== 0) return -1;
+  var single = (fhd & 0x20) !== 0;
+  var fcs = _ZSTD_FCS_BYTES[fhd >>> 6];
+  if (fcs === 0 && single) fcs = 1;
+  var p = 5 + (single ? 0 : 1) + _ZSTD_DID_BYTES[fhd & 0x03] + fcs;
+  for (;;) {
+    if (p + 3 > n) return -1;
+    var h = s[p] | (s[p + 1] << 8) | (s[p + 2] << 16);
+    var type = (h >>> 1) & 0x03;
+    if (type === 3) return -1;
+    p += 3 + (type === 1 ? 1 : (h >>> 3));
+    if (p > n) return -1;
+    if ((h & 0x01) !== 0) break;
+  }
+  if ((fhd & 0x04) !== 0) p += 4;
+  return p > n ? -1 : p;
+}
+
+var FRAME_LENGTH = _intrinsic.assign(_intrinsic.create(null), { zstd: _zstdFrameLength });
+
 function _reportsTruncation(name) {
   var compress = _PROBE_COMPRESS[name];
   var decompress = DECOMPRESS[name];
@@ -51,7 +82,7 @@ var SAFE = _intrinsic.create(null);
 _intrinsic.forEach(_objectKeys(DECOMPRESS), function (n) { if (_reportsTruncation(n)) SAFE[n] = true; });
 
 // @enforced-by guard-shape-reinlined
-// @guard-shape \bzlib\.(inflate|brotliDecompress|zstdDecompress)Sync\b
+// @guard-shape \bzlib\.(?:inflate|inflateRaw|gunzip|unzip|brotliDecompress|zstdDecompress|createInflate|createInflateRaw|createGunzip|createUnzip|createBrotliDecompress|createZstdDecompress)(?:Sync)?\b
 // @guard-via \bguard\.compress\.bounded\s*\(
 function bounded(algorithm, stream, cap, E, codes, label) {
   var decompress = DECOMPRESS[algorithm];
@@ -65,6 +96,10 @@ function bounded(algorithm, stream, cap, E, codes, label) {
     throw new TypeError("guard.compress.bounded: cap must be a positive integer");
   }
   var what = label || "the compressed input";
+  var frameLength = FRAME_LENGTH[algorithm];
+  if (frameLength && frameLength(stream) !== _sizeOf(stream)) {
+    throw E(codes.failed, what + " is not exactly one " + algorithm + " frame");
+  }
   var res;
   try {
     res = decompress(stream, { maxOutputLength: cap, info: true });

package/lib/guard-identifier.js

@@ -101,7 +101,7 @@ function assertKnownKeys(obj, known, E, code, message) {
  * Which of the two a given name is depends on the function and the engine. A STRICT function, which
  * is every function in an ES module or a `"use strict"` file, owns neither `arguments` nor `caller`,
  * and `Function.prototype` carries both as the restricted accessors, so a chain walk finds them
- * there. On the Node 24.21.0 floor a non-strict function owns both outright. Measured before this
+ * there. On the Node 24.22.1 floor a non-strict function owns both outright. Measured before this
  * covered the inherited side: a plain strict callable descriptor was refused for `arguments` by
  * `pki.cms.sign` and `pki.cms.countersign`, while the minted floor shape passed, which is the shape
  * the vectors were written on.
@@ -372,7 +372,7 @@ function _kindMembers(v) {
 /** @internal The names a callable carries before a caller assigns a field, asked of the engine
  *  rather than listed here: a function's own names, plus `Function.prototype`'s, which is where the
  *  restricted `arguments` and `caller` accessors live. Which of them a given function makes OWN
- *  depends on the engine. Measured: on Node 24.21.0, the version `engines.node` floors at, every
+ *  depends on the engine. Measured: on Node 24.22.1, the version `engines.node` floors at, every
  *  non-strict function carries own `arguments` and `caller`; on 26.9.0 none does, for a declaration
  *  and for `new Function` alike. A list written against one of those refuses a legitimate callable
  *  descriptor on the other, and a caller's non-strict CommonJS module is where the shape comes
@@ -418,7 +418,7 @@ function isOwnMachineryName(v, k) {
   if (v === null || v === undefined) return false;
   var d = _getOwnPropertyDescriptor(v, k);
   /** @internal A DATA property, because that is what the machinery is: measured on both Node
-   *  24.21.0 and 26.9.0, every one of these names a function owns is a non-enumerable data
+   *  24.22.1 and 26.9.0, every one of these names a function owns is a non-enumerable data
    *  property. An accessor a caller installed under one of those names is therefore theirs, and it
    *  reaches the unknown-field refusal by its name rather than being exempted and ignored. Asking
    *  the descriptor rather than reading the property leaves the getter uninvoked either way. */

package/lib/guard-intrinsic.js

@@ -267,7 +267,7 @@ var _strSliceOwn = uncurry(String.prototype.slice);
  *  `String.prototype.split` is specified to look the separator's `Symbol.split` method up and call
  *  it (ES2015 21.1.3.19 step 2), so the separator's prototype chain is part of the operation and a
  *  capture of `split` does not close it. Hard rule 11 bans `split` in `lib/` for exactly that
- *  reason. MEASURED on Node 24.21, the supported runtime: a captured split with a string separator
+ *  reason. MEASURED on Node 24.22.1, the supported runtime: a captured split with a string separator
  *  DOES dispatch to an installed `String.prototype[Symbol.split]`, and that made
  *  `isBlockedIp("127.0.0.1")` answer false, so a request to loopback proceeded under
  *  `blockPrivateAddresses`. Node 26.9 fast-paths a primitive-string separator past the lookup, which

package/lib/guard-name.js

@@ -446,12 +446,6 @@ function _charTable(chars) {
   for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true;
   return t;
 }
-var _DIGDOT_TABLE = _charTable("0123456789.");
-function _allCharsIn(s, table) {
-  if (s.length === 0) return false;
-  for (var i = 0; i < s.length; i++) if (!table[_charCodeAt(s, i)]) return false;
-  return true;
-}
 
 /** @internal The one trailing dot a host name may be written with, removed before it is compared.
  *
@@ -485,7 +479,7 @@ function isFqdnHost(host) {
   if (typeof host !== "string") return false;
   var h = stripTrailingDot(host);
   if (!_isHostName(h)) return false;
-  if (_allCharsIn(h, _DIGDOT_TABLE)) return false;
+  if (_ipUtils.endsInANumber(h)) return false;
   return true;
 }
 
@@ -527,6 +521,13 @@ function _isHostName(s) {
 // @enforced-by behavioral -- an LDH label walk has no rename-proof shape that separates it from any other per-character scan; the vectors refusing an empty label, a hyphen at a label edge and a name past 253 octets are the guard
 function isHostName(s) { return typeof s === "string" && _isHostName(s); }
 
+/** @internal Whether a character code can appear in a host name a caller hands the toolkit: a letter,
+ * a digit, a hyphen, a dot or an underscore. A percent escape is decoded by WHATWG URL, so
+ * `127.0.0.%31` reaches 127.0.0.1, and a colon or a bracket spells an IPv6 address; neither is a
+ * host name. */
+// @enforced-by behavioral -- a character-class test has no rename-proof shape; the vectors refusing a percent escape, a colon and a bracket in a reference identity and in a TLS servername are the guard
+function isHostNameChar(c) { return _LDH_ALNUM[c] === true || c === 0x2d || c === 0x2e || c === 0x5f; }
+
 /** @internal The labels of `s`, in order, with no trailing-dot handling of its own: the caller
  * normalizes the dot through `stripTrailingDot` so both sides of a comparison are normalized by
  * one symbol. A name carrying an empty label yields an empty string at that position, which a
@@ -1019,7 +1020,7 @@ function constraintBaseRefusal(tag, base) {
     var uriBody = _toLowerCase(base);
     if (_charAt(uriBody, 0) === ".") uriBody = _strSlice(uriBody, 1);
     if (isFqdnHost(uriBody)) return null;
-    return _allCharsIn(stripTrailingDot(uriBody), _DIGDOT_TABLE)
+    return _ipUtils.endsInANumber(uriBody)
       ? "must be a domain name rather than an address, RFC 5280 sec. 4.2.1.10 naming an address in a URI's authority as what a URI constraint cannot be compared against"
       : "must be a domain name, which RFC 5280 sec. 4.2.1.10 requires of a URI constraint, optionally written as a subtree with a leading dot";
   }
@@ -1148,7 +1149,7 @@ module.exports = intrinsic.freeze({
   isAttributeDescriptor: isAttributeDescriptor,
   lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,
-  isHostName: isHostName, hostLabels: hostLabels, isXnLabel: isXnLabel, uriParts: uriParts,
+  isHostName: isHostName, isHostNameChar: isHostNameChar, hostLabels: hostLabels, isXnLabel: isXnLabel, uriParts: uriParts,
   uriEqual: uriEqual, dnsNameEqual: dnsNameEqual, generalNameEqual: generalNameEqual,
   constraintBaseRefusal: constraintBaseRefusal,
   constraintBaseUnreadable: constraintBaseUnreadable,

package/lib/http-transport.js

@@ -88,6 +88,7 @@ var nodeUtil = require("node:util");
 var constants = require("./constants");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var ipUtils = require("./ip-utils");
 /** @internal The certificate reader, and the two operations the distrust walk proves a link with,
  *  taken at load. A replaced `verify` would answer whether each link of a server chain is signed by
  *  the certificate above it. */
@@ -581,7 +582,7 @@ function _isBlockedIp(ip) {
     /** @internal The literal is scanned on the delimiter CHARACTER rather than split on a separator
      * string. `String.prototype.split` is specified to look the separator's `Symbol.split` method up
      * and call it, so the separator's prototype chain is part of the operation and capturing `split`
-     * does not close it; hard rule 11 bans `split` in lib/ for that reason. MEASURED on Node 24.21,
+     * does not close it; hard rule 11 bans `split` in lib/ for that reason. MEASURED on Node 24.22.1,
      * the supported runtime: a hook answering with a public address's octets made this refusal clear
      * for `127.0.0.1` and a request to loopback proceeded. */
     var o = intrinsic.splitChar(ip, 46), a = +o[0], b = +o[1], c = +o[2];
@@ -697,6 +698,25 @@ var PROXY_KEYS = _keySet(["url", "auth", "tls"]);
 var PROXY_AUTH_KEYS = _keySet(["scheme", "username", "password", "allowMD5", "allowLegacyQop"]);
 var PROXY_DIGEST_KNOBS = ["allowMD5", "allowLegacyQop"];
 var PROXY_TLS_KEYS = _keySet(["anchors", "useSystemStore", "servername", "minVersion", "distrustedKeys"]);
+/** @internal A servername is a DNS name (RFC 6066 sec. 3) of letters, digits, hyphens, dots and
+ *  underscores, or a canonical address literal. A percent escape or a bracketed IPv6 address is
+ *  neither. A value whose last label is a number but which is not a canonical address (`0x7f.0.0.1`,
+ *  `0177.0.0.1`, `127.1`, `127.0.0.1.`, or `127.0.0.1` in fullwidth digits) is an address in another
+ *  spelling. Node below 24.22.1 matched such a name against the certificate's dNSName entries
+ *  (CVE-2026-106072, CVE-2026-105483), so `DNS:127.0.0.1` authenticated it. It is refused here
+ *  whatever the runtime does. */
+function _assertServername(s, E, code, what) {
+  if (_isIP(s)) return;
+  for (var i = 0; i < s.length; i++) {
+    if (!guard.name.isHostNameChar(_charCodeAt(s, i))) {
+      throw E(code, what + " carries a character at offset " + i + " that no host name holds; a servername is a DNS " +
+        "name of letters, digits, hyphens, dots and underscores (RFC 6066 sec. 3) or a canonical address literal");
+    }
+  }
+  if (ipUtils.endsInANumber(s)) {
+    throw E(code, what + " " + guard.text.showValue(s) + " is an IPv4 address in a non-canonical spelling; pass the canonical dotted quad or a DNS name");
+  }
+}
 /** @internal The names a `tls` policy bag may carry. A name outside them is refused rather than
  *  ignored: a misspelled `distrustedKeys` or `anchors` would otherwise leave the connection under a
  *  policy the caller did not state. */
@@ -820,6 +840,7 @@ function _validateProxy(request, defaults, E, C, originHost, originStatedPort, o
       if (!_copyableRecord(ptls)) throw E(C("bad-proxy"), "opts.proxy.tls must be a plain object with only own enumerable data properties");
       guard.identifier.assertKnownKeys(ptls, PROXY_TLS_KEYS, E, C("bad-proxy"), "opts.proxy.tls has an unknown option ");
       if (ptls.servername !== undefined && ptls.servername !== null && typeof ptls.servername !== "string") throw E(C("bad-proxy"), "opts.proxy.tls.servername must be a string");
+      if (typeof ptls.servername === "string") _assertServername(ptls.servername, E, C("bad-proxy"), "opts.proxy.tls.servername");
     }
     /** @internal Taken here, so the value the tunnel is opened under is the one typed above rather
      * than a later read of the caller's record. The door refuses an accessor and refuses a Proxy, so
@@ -1107,6 +1128,7 @@ function httpsTransport(defaults) {
      * as `idHost` for the name the server certificate is matched against. A value answering a
      * different string per read sends one name and verifies another. */
     if (typeof sni !== "string") throw E(C("bad-input"), "tls.servername must be a string, got " + guard.text.showValue(sni));
+    _assertServername(sni, E, C("bad-input"), "tls.servername");
     if (sni && !_isIP(sni)) options.servername = sni;
     var caList = [];
     if (hasAnchors) {

package/lib/identity-match.js

@@ -89,6 +89,27 @@ function _assertNoWildcard(s, what) {
   }
 }
 
+/** @internal A domain is a host name and never an address. Its characters are letters, digits,
+ * hyphens, dots and underscores, so a percent escape (`127.0.0.%31`, which WHATWG URL decodes to
+ * 127.0.0.1) and an IPv6 spelling (`::1`, `[::1]`) are refused. RFC 9525 sec. 3 classifies an IP
+ * address as an IP-ID and sec. 6.4 never compares one as a DNS-ID. A resolver and WHATWG URL read any host whose last label
+ * is a number as IPv4 (`0x7f.0.0.1`, `0177.0.0.1`, `127.1`, `2130706433`, `127.0.0.1.`), and
+ * `0127.0.0.1` reaches 87.0.0.1 under URL but 127.0.0.1 under some resolvers. Compared as a domain,
+ * such a value was authenticated by a dNSName like `127.0.0.1` or `*.0.0.1`. */
+function _assertNotAnAddress(v, what) {
+  for (var i = 0; i < v.length; i++) {
+    if (!guard.name.isHostNameChar(_charCodeAt(v, i))) {
+      throw E("identity/bad-reference", what + " carries " + guard.text.showValue(v[i]) + " at offset " + i +
+        ", which no host name holds. A host name is letters, digits, hyphens, dots and underscores; a percent " +
+        "escape is decoded by WHATWG URL and a colon or bracket spells an IPv6 address");
+    }
+  }
+  if (ip.endsInANumber(v)) {
+    throw E("identity/bad-reference", what + " is read as an IPv4 address by a resolver and by WHATWG URL, so it is " +
+      "not a domain name. Pass an address as the canonical dotted quad or as octets (RFC 9525 sec. 3)");
+  }
+}
+
 /** @internal The domain of a reference identity, normalized the way both sides are normalized: one
  * trailing dot stripped, then held to the label rules so an empty label or a label past 63
  * characters is a caller mistake, not a name that can never match. */
@@ -96,6 +117,7 @@ function _referenceDomain(v, what) {
   if (typeof v !== "string" || v === "") throw E("identity/bad-reference", what + " must be a non-empty string");
   _assertAsciiReference(v, what);
   _assertNoWildcard(v, what);
+  _assertNotAnAddress(v, what);
   var d = _stripTrailingDot(v);
   if (d === "" || d.length > MAX_HOST) {
     throw E("identity/bad-reference", what + " must be a domain name of 1 to " + MAX_HOST + " characters");
@@ -487,6 +509,11 @@ function _search(refs, entries, wildcardsAllowed) {
  * its service type and its domain together, so no comparison can pair the service of one
  * reference with the domain of another (sec. 6.5).
  *
+ * A domain whose last label is a number, such as `0x7f.0.0.1`, `0177.0.0.1`, `127.1`,
+ * `2130706433` or `127.0.0.1.`, is an IPv4 address to a resolver and to WHATWG URL, so it is
+ * refused with `identity/bad-reference` in every form rather than compared against dNSName
+ * entries. An address is passed as the canonical dotted quad or as octets.
+ *
  * The subject distinguished name is never a source of identity. The `commonName` is not read
  * under any option or fallback, including when the certificate carries no subjectAltName at
  * all, and neither is any other RDN (sec. 2, RFC 9110 sec. 4.3.4). A certificate presenting

package/lib/ip-utils.js

@@ -42,6 +42,29 @@ function isIPv4(s) {
   return true;
 }
 
+/** @internal Whether a host is one WHATWG URL parses as IPv4: the "ends in a number" check of the
+ *  URL Standard's host parser. With one trailing dot dropped, the last label is all ASCII digits, or
+ *  `0x` / `0X` followed by hex digits or nothing. A resolver (inet_aton) reads the same strings as
+ *  an address, so `0x7f.0.0.1`, `0177.0.0.1`, `127.1`, `2130706433` and `127.0.0.1.` all name
+ *  127.0.0.1. A host this answers true for and `isIPv4` answers false for is an address in a
+ *  non-canonical spelling, never a domain name. */
+function endsInANumber(s) {
+  if (typeof s !== "string") return false;
+  var parts = _splitOn(s, ".");
+  if (parts[parts.length - 1] === "") {
+    if (parts.length === 1) return false;
+    parts.length -= 1;
+  }
+  var last = parts[parts.length - 1], n = last.length, i;
+  if (n === 0) return false;
+  var digits = true;
+  for (i = 0; i < n; i += 1) { if (!_isDigitCode(_charCodeAt(last, i))) { digits = false; break; } }
+  if (digits) return true;
+  if (n < 2 || _charCodeAt(last, 0) !== 48 || (_charCodeAt(last, 1) | 0x20) !== 0x78) return false;
+  for (i = 2; i < n; i += 1) { if (!_isHexCode(_charCodeAt(last, i))) return false; }
+  return true;
+}
+
 function _isHexGroup(g) {
   var n = g.length, i;
   if (n < 1 || n > 4) return false;
@@ -151,6 +174,6 @@ function canonicalizeIpv6(value) {
 }
 
 module.exports = {
-  isIPv4: isIPv4, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, packIpLiteral: packIpLiteral,
+  isIPv4: isIPv4, endsInANumber: endsInANumber, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, packIpLiteral: packIpLiteral,
   textFromOctets: textFromOctets, canonicalizeIpv6: canonicalizeIpv6,
 };

package/lib/tls-cert-compress.js

@@ -40,7 +40,7 @@
  *   all rather than faulting is dropped, because a runtime that accepts a cut
  *   frame lets a peer strip a frame's tail and have the receiver read a prefix as
  *   the whole message. A dropped algorithm is then neither compressed to nor
- *   accepted. At the Node 24.21 engine floor all three qualify; on a runtime
+ *   accepted. At the Node 24.22.1 engine floor all three qualify; on a runtime
  *   where one does not, it is dropped.
  *
  * @card

package/lib/vendor/MANIFEST.json

@@ -1,4 +1,4 @@
 {
-  "_comment": "Vendored dependencies: none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.21) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
+  "_comment": "Vendored dependencies: none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.22.1) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
   "packages": {}
 }

package/lib/vendor/README.md

@@ -6,7 +6,7 @@ nothing. This directory holds only the manifest.
 ## Native-first crypto
 
 The toolkit's cryptography runs entirely on Node's built-in `node:crypto`. The
-engine floor (Node `>=24.21`) links OpenSSL 3.5, which provides:
+engine floor (Node `>=24.22.1`) links OpenSSL 3.5, which provides:
 
 - the full classical set: RSA (PKCS#1 v1.5, PSS, OAEP), ECDSA, EdDSA
   (Ed25519/Ed448), ECDH including X25519 and X448, AES (GCM/CBC/CTR/KW), HMAC,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -51,7 +51,7 @@
     "owns-its-stack"
   ],
   "engines": {
-    "node": ">=24.21.0"
+    "node": ">=24.22.1"
   },
   "files": [
     "index.js",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1f2b6ec8-3dcd-4f4f-abc6-92aeb5ba8795",
+  "serialNumber": "urn:uuid:8b9305d6-9fdd-4cc8-9197-8b59f0469f8f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-21T20:18:37.023Z",
+    "timestamp": "2026-10-27T18:43:36.397Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -15,18 +15,18 @@
       {
         "vendor": "npm",
         "name": "cli",
-        "version": "11.19.0"
+        "version": "11.19.1"
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.9.7",
+      "bom-ref": "@blamejs/pki@0.9.9",
       "type": "application",
       "name": "pki",
-      "version": "0.9.7",
+      "version": "0.9.9",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.9.7",
+      "purl": "pkg:npm/%40blamejs/pki@0.9.9",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.9.7",
+      "ref": "@blamejs/pki@0.9.9",
       "dependsOn": []
     }
   ]