@daloyjs/core 0.30.0 → 0.34.0

package/dist/app.js

@@ -2,11 +2,12 @@ import { Router } from "./router.js";
 import { WebSocketRegistry, normalizeWebSocketOptions, } from "./websocket.js";
 import { BadRequestError, ForbiddenError, HttpError, InternalError, MethodNotAllowedError, NotFoundError, PayloadTooLargeError, RequestTimeoutError, TooManyRequestsError, UnsupportedMediaTypeError, ValidationError, } from "./errors.js";
 import { validate } from "./schema.js";
-import { readBodyLimited, safeJsonParse, randomId, assertNoDuplicateSingletonHeaders, assertStrongSecret, timingSafeEqual } from "./security.js";
+import { readBodyLimited, safeJsonParse, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertStrongSecret, timingSafeEqual, isForbiddenObjectKey } from "./security.js";
 import { createLogger, noopLogger } from "./logger.js";
 import { generateOpenAPI, openapiToYAML, } from "./openapi.js";
 import { docsContentSecurityPolicy, scalarHtml, swaggerUiHtml, } from "./docs.js";
 import { secureHeaders as secureHeadersMiddleware, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, CSRF_HOOK_MARKER, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, SECURE_HEADERS_MARKER, } from "./middleware.js";
+import { COMPRESSION_HOOK_MARKER } from "./compression.js";
 import { SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER, } from "./session.js";
 import { loadShedding as loadSheddingMiddleware } from "./load-shedding.js";
 import { securitySchemeRequiresPayloadAuth } from "./security-schemes.js";
@@ -29,8 +30,8 @@ export function _resetCrashHandlersForTests() {
     activeCrashLogger = undefined;
 }
 /**
- * Wave 8 — once-per-process latch for the `secureDefaults: false` warning
- * log. Multiple `new App({ secureDefaults: false })` instances in the same
+ * Once-per-process latch for the `secureDefaults: false` warning log.
+ * Multiple `new App({ secureDefaults: false })` instances in the same
  * process share one log entry instead of flooding the access log with
  * duplicate warnings on every construction.
  */
@@ -40,9 +41,9 @@ export function _resetInsecureDefaultsLogForTests() {
     insecureDefaultsLoggedThisProcess = false;
 }
 /**
- * Wave 8 — list of secure-by-default surfaces disabled when
- * `secureDefaults: false` is set. Surfaced through the once-per-process
- * `error` log so the operator sees exactly which guards are off.
+ * List of secure-by-default surfaces disabled when `secureDefaults: false`
+ * is set. Surfaced through the once-per-process `error` log so the operator
+ * sees exactly which guards are off.
  */
 const DISABLED_BY_INSECURE_DEFAULTS = Object.freeze([
     "secureHeaders auto-install",
@@ -54,6 +55,25 @@ const DISABLED_BY_INSECURE_DEFAULTS = Object.freeze([
     "cors({ origin: '*' }) refuse-to-boot",
     "anonymous stateful plugin refuse-to-boot",
 ]);
+/**
+ * The exact RFC 7231 + RFC 5789 HTTP-method allowlist.
+ * The framework refuses any other method at route-registration time so
+ * `TRACE`, `CONNECT`, and WebDAV verbs (`MKCOL`, `COPY`, `PROPFIND`,
+ * `MOVE`, etc.) cannot bypass the strict Content-Type / body-on-GET /
+ * TRACE-and-CONNECT-refusal defaults. The set mirrors the `HttpMethod`
+ * union exported from `./types.ts`.
+ *
+ * @internal
+ */
+const CANONICAL_HTTP_METHODS = new Set([
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "HEAD",
+    "OPTIONS",
+]);
 const DEFAULTS = {
     bodyLimitBytes: 1024 * 1024,
     requestTimeoutMs: 30_000,
@@ -127,7 +147,7 @@ export class App {
     installedPlugins = new Set();
     closeHooks = [];
     closeHooksRun = false;
-    /** Wave 4 idle-connection close hooks (adapter-registered, sync). */
+    /** Idle-connection close hooks (adapter-registered, sync). */
     idleConnectionCloseHooks = [];
     pluginInstalledListeners = [];
     shutdownListeners = [];
@@ -148,13 +168,13 @@ export class App {
      */
     corsOriginAllows = [];
     /**
-     * Whether the Wave 3 once-only boot guard has run (session + CSRF +
-     * state-changing-route check). The check is deferred to first request
+     * Whether the once-only session + CSRF + state-changing-route boot
+     * guard has run. The check is deferred to first request
      * because route registration and `app.use(csrf(...))` can happen in any
      * order after construction; doing it on first `fetch()` is the latest
      * point we still get a 500 before any handler ever runs.
      */
-    wave3BootGuard = { checked: false };
+    bootGuard = { checked: false };
     /**
      * Latched marker stamped after the framework has reported the first
      * unconfigured-proxy request. Logged once at `warn` level so production
@@ -186,7 +206,7 @@ export class App {
         this.maybeMountDocs();
     }
     /**
-     * Wave 4 leftover: validate {@link AppOptions.disconnectStatusCode}.
+     * Validate {@link AppOptions.disconnectStatusCode}.
      * Refuses anything outside `[400, 499]` (except `0`, which disables the
      * rewrite). Throws at construction time so the misconfiguration cannot
      * survive past boot.
@@ -200,7 +220,7 @@ export class App {
         }
     }
     /**
-     * Wave 8 — master-flag escape-hatch enforcement. When
+     * Master-flag escape-hatch enforcement. When
      * `secureDefaults: false` is set, the framework:
      *  - refuses-to-construct in production unless
      *    `acknowledgeInsecureDefaults: true` is also set; closes the
@@ -216,7 +236,7 @@ export class App {
         const inProduction = this.isProduction();
         if (inProduction && this.options.acknowledgeInsecureDefaults !== true) {
             throw new Error("app({ secureDefaults: false }) is refused in production. " +
-                "secureDefaults turns off the entire Wave 1–7 secure-by-default " +
+                "secureDefaults turns off the entire secure-by-default " +
                 "surface (auto secureHeaders, cross-origin guard, crash-on-unhandled-rejection, " +
                 "trustProxy guard, csrf/session boot guard, weak-secret refuse-to-boot, " +
                 "cors({ origin: '*' }) refuse-to-boot, anonymous-stateful-plugin refuse-to-boot). " +
@@ -236,7 +256,7 @@ export class App {
         }
     }
     /**
-     * Install the Wave 2 secure-by-default global hooks. Currently:
+     * Install the secure-by-default global hooks. Currently:
      *  - {@link secureHeaders} as a group-level hook so every response carries
      *    the hardened baseline (HSTS, X-Frame-Options, nosniff, default CSP).
      *
@@ -258,7 +278,7 @@ export class App {
             auto[AUTO_SECURE_HEADERS_MARKER] = true;
             this.groupHooks.push(auto);
         }
-        // Wave 4 leftover: opt-in load-shedding pressure monitor.
+        // Opt-in load-shedding pressure monitor.
         if (this.options.loadShedding) {
             const lsOpts = typeof this.options.loadShedding === "object"
                 ? this.options.loadShedding
@@ -267,7 +287,7 @@ export class App {
         }
     }
     /**
-     * Wave 4 crash-on-unrecoverable-error guard. Installs Node-process-level
+     * Crash-on-unrecoverable-error guard. Installs Node-process-level
      * listeners for `unhandledRejection` and `uncaughtException` that log
      * through the pluggable logger and call `process.exit(1)`. Idempotent via
      * a module-level latch so multiple `new App()` instantiations in the same
@@ -343,7 +363,7 @@ export class App {
             process.env.NODE_ENV === "production");
     }
     /**
-     * Wave 2 cross-origin guard. Rejects state-changing requests (`POST` /
+     * Cross-origin guard. Rejects state-changing requests (`POST` /
      * `PUT` / `PATCH` / `DELETE`) that carry an `Origin` header pointing at a
      * different origin than the request URL when no {@link cors} hook is
      * registered (neither at the app level nor on the matched route). Throws
@@ -388,7 +408,7 @@ export class App {
             `app({ corsCrossOriginGuard: false }) / app({ secureDefaults: false }) to disable this guard.`);
     }
     /**
-     * Wave 3 sync boot guard. Inspects a hook layer being installed via
+     * Sync boot guard. Inspects a hook layer being installed via
      * {@link App.use} and refuses-to-boot when:
      *
      *  - `cors({ origin: "*" })` is registered while resolved environment is
@@ -431,12 +451,12 @@ export class App {
             `but security scheme "${auth.scheme}" requires payload authentication. ` +
             `Remove the route-level opt-out or use a scheme without requirePayloadAuth: true.`);
     }
-    resetWave3BootGuardCache() {
-        this.wave3BootGuard.checked = false;
-        this.wave3BootGuard.error = undefined;
+    resetBootGuardCache() {
+        this.bootGuard.checked = false;
+        this.bootGuard.error = undefined;
     }
     /**
-     * Wave 3 first-request boot guard. Verifies that the assembled hook
+     * First-request boot guard. Verifies that the assembled hook
      * chain + route table is internally consistent before any user handler
      * runs. Currently checks: when `session()` is installed and any route
      * accepts a state-changing method (`POST` / `PUT` / `PATCH` / `DELETE`),
@@ -446,13 +466,13 @@ export class App {
      * `app({ secureDefaults: false })`. Runs once per App between registration
      * changes; the result is cached so the fast path is a single boolean check.
      */
-    assertWave3BootGuards() {
-        if (this.wave3BootGuard.checked) {
-            if (this.wave3BootGuard.error)
-                throw this.wave3BootGuard.error;
+    assertBootGuards() {
+        if (this.bootGuard.checked) {
+            if (this.bootGuard.error)
+                throw this.bootGuard.error;
             return;
         }
-        this.wave3BootGuard.checked = true;
+        this.bootGuard.checked = true;
         if (this.options.secureDefaults === false)
             return;
         if (this.options.csrf === "off")
@@ -469,11 +489,11 @@ export class App {
             `(${stateChanging.method} ${stateChanging.path}) but no csrf() hook is installed. ` +
             `Register csrf() via app.use(csrf({ strategy: "fetch-metadata", allowedOrigins: [...] })), ` +
             `or pass app({ csrf: "off" }) to acknowledge that this app is not browser-facing.`);
-        this.wave3BootGuard.error = err;
+        this.bootGuard.error = err;
         throw err;
     }
     /**
-     * Wave 3 per-request guard for spoofed proxy headers. When the App was
+     * Per-request guard for spoofed proxy headers. When the App was
      * constructed without an explicit {@link AppOptions.trustProxy} value
      * and a request arrives carrying an `X-Forwarded-*` header, refuse to
      * dispatch it: the rate limiter, audit log, and request-id propagation
@@ -487,7 +507,7 @@ export class App {
             return;
         if (this.options.trustProxy !== undefined)
             return;
-        // Wave 6: `behindProxy` is the declarative successor — when supplied,
+        // `behindProxy` is the declarative successor — when supplied,
         // the framework already knows how to interpret forwarded headers and
         // the legacy unconfigured-proxy guard is satisfied.
         if (this.options.behindProxy !== undefined)
@@ -681,6 +701,20 @@ export class App {
      * @returns This `App` instance for chaining.
      */
     route(def) {
+        // Refuse non-canonical HTTP methods at runtime.
+        // The TypeScript `HttpMethod` union already constrains the public
+        // surface, but an unsafe cast (or a runtime caller in plain JS)
+        // could bypass it. Closes the "framework silently routes WebDAV /
+        // TRACE / CONNECT" class of bypass-via-extended-method bugs at the
+        // framework boundary.
+        if (!CANONICAL_HTTP_METHODS.has(def.method)) {
+            throw new Error(`app.route(): HTTP method "${String(def.method)}" is not on ` +
+                `the RFC 7231 + RFC 5789 allowlist. Allowed: ` +
+                `${[...CANONICAL_HTTP_METHODS].join(", ")}. Custom methods ` +
+                `(TRACE, CONNECT, WebDAV verbs, etc.) bypass the strict ` +
+                `Content-Type, body-on-GET, and TRACE/CONNECT refusal ` +
+                `defaults and are not supported.`);
+        }
         if (def.hooks)
             this.assertSecureHookConfig(def.hooks);
         const fullPath = joinPath(this.prefix, def.path);
@@ -705,7 +739,7 @@ export class App {
             path: merged.path,
             ...securityMarkers,
         });
-        this.resetWave3BootGuardCache();
+        this.resetBootGuardCache();
         return this;
     }
     /**
@@ -717,10 +751,65 @@ export class App {
      */
     ws(path, handler) {
         const fullPath = joinPath(this.prefix, path);
+        const production = this.isProduction();
+        const secureDefaults = this.options.secureDefaults !== false;
         const options = normalizeWebSocketOptions(handler, {
-            production: this.isProduction(),
-            secureDefaults: this.options.secureDefaults !== false,
+            production,
+            secureDefaults,
         });
+        // Pre-upgrade authentication boundary. In production under
+        // secureDefaults, a WebSocket route must either make an explicit
+        // pre-upgrade decision (`beforeUpgrade`) or acknowledge that the route is
+        // intentionally public. This prevents accidental auth in `open()` after
+        // the 101 response has already committed the connection.
+        if (production &&
+            secureDefaults &&
+            handler.beforeUpgrade === undefined &&
+            handler.acknowledgeUnauthenticated !== true) {
+            throw new Error(`app.ws(${JSON.stringify(fullPath)}): production WebSocket routes must ` +
+                "authenticate or reject clients before the RFC 6455 upgrade. Add a " +
+                "beforeUpgrade hook for authenticated routes, or pass " +
+                "{ acknowledgeUnauthenticated: true } for an intentionally public route.");
+        }
+        // Cross-Site WebSocket Hijacking (CSWSH) guard. Storybook's
+        // CVE-2026-27148 — and the Cross-Site WebSocket Hijacking class of bug
+        // in general — exploits the fact that browsers attach cookies on a WS
+        // upgrade no matter which origin opened the connection. A
+        // `beforeUpgrade` hook that only checks cookies/JWTs still accepts the
+        // attacker's handshake. Refuse-at-registration unless the route either
+        // sets an Origin allowlist or explicitly acknowledges the exposure.
+        if (production &&
+            secureDefaults &&
+            handler.allowedOrigins === undefined &&
+            handler.acknowledgeCrossOriginUpgrade !== true) {
+            throw new Error(`app.ws(${JSON.stringify(fullPath)}): production WebSocket routes must ` +
+                "guard against Cross-Site WebSocket Hijacking (CSWSH). Set " +
+                "{ allowedOrigins: \"same-origin\" } or an explicit origin allowlist, " +
+                "or pass { acknowledgeCrossOriginUpgrade: true } for an intentionally " +
+                "public route. See https://daloyjs.dev/docs/websocket " +
+                "and CVE-2026-27148 (Storybook) for the attack pattern.");
+        }
+        // WebSocket post-upgrade header immutability. Once the RFC
+        // 6455 101 handshake has been sent, no further response headers can be
+        // added by middleware; mounting header-mutating middleware on a path
+        // that also matches a WS route is a documented misconfiguration in
+        // upstream frameworks. Refuse-at-registration with a structured error
+        // naming both the WS route and the conflicting middleware unless the
+        // developer explicitly acknowledges the configuration.
+        if (handler.acknowledgeHeaderMutatingMiddleware !== true) {
+            const conflicts = detectHeaderMutatingMiddleware([
+                this.options.hooks ?? {},
+                ...this.groupHooks,
+            ]);
+            if (conflicts.length > 0) {
+                throw new Error(`app.ws(${JSON.stringify(fullPath)}): ${conflicts.join(", ")} ` +
+                    "middleware is mounted on a path that matches this WebSocket " +
+                    "route, but no response headers can be added after the RFC 6455 " +
+                    "upgrade. Either move the middleware below the WebSocket scope, " +
+                    "or pass { acknowledgeHeaderMutatingMiddleware: true } after " +
+                    "confirming the middleware does not run on Upgrade requests.");
+            }
+        }
         this.webSocketRoutes.add(fullPath, handler, () => ({ ...this.decorations }), options);
         return this;
     }
@@ -730,7 +819,7 @@ export class App {
      * container orchestrator `livenessProbe` configuration — a failing
      * liveness probe restarts the container.
      *
-     * Defaults (Wave 4 secure-by-default):
+     * Defaults (secure-by-default):
      *  - path: `/healthz`
      *  - rate-limit: 60 req/min per remote IP, in-memory (per-process)
      *  - auth: opt-in via `token`. In production with `secureDefaults: true`,
@@ -789,7 +878,7 @@ export class App {
             ? null
             : { limit: 60, windowMs: 60_000, ...(opts.rateLimit ?? {}) };
         const token = opts.token;
-        // Wave 4 refuse-to-boot: unauthenticated health/ready probes in
+        // Refuse-to-boot: unauthenticated health/ready probes in
         // production are a documented info-disclosure surface (process uptime,
         // plugin-ready transitions, internal hostnames in some shops). Force
         // an explicit acknowledgement.
@@ -852,7 +941,7 @@ export class App {
         });
     }
     /**
-     * Wave 4 leftover: register a built-in receiver for CSP / Reporting API
+     * Register a built-in receiver for CSP / Reporting API
      * violation reports. Accepts `application/csp-report` and
      * `application/reports+json` payloads, rate-limits per IP (defaults: 60
      * req/min), caps body size (default 8 KiB), and forwards parsed reports
@@ -868,7 +957,7 @@ export class App {
     cspReportRoute(opts = {}) {
         const path = (opts.path ?? "/__csp-report");
         const maxBytes = opts.maxBodyBytes ?? 8192;
-        // Wave 11 — refuse a configured cap above 64 KiB so a misconfigured
+        // Refuse a configured cap above 64 KiB so a misconfigured
         // policy cannot turn the receiver into a DoS-via-report-flood amplifier.
         const HARD_MAX = 65536;
         if (!Number.isInteger(maxBytes) || maxBytes <= 0 || maxBytes > HARD_MAX) {
@@ -881,7 +970,7 @@ export class App {
             ? new Map()
             : null;
         const log = this.log;
-        // Wave 11 — only log report bodies when explicitly enabled. In
+        // Only log report bodies when explicitly enabled. In
         // production this is opt-in; in development the body is included by
         // default so violations are debuggable.
         const includeReportBody = opts.logCspReportBodies ?? !this.isProduction();
@@ -993,7 +1082,7 @@ export class App {
         child.routes = this.routes;
         child.webSocketRoutes = this.webSocketRoutes;
         child.routeSecurityMarkers = this.routeSecurityMarkers;
-        child.wave3BootGuard = this.wave3BootGuard;
+        child.bootGuard = this.bootGuard;
         child.log = this.log;
         child.prefix = joinPath(this.prefix, prefix);
         child.groupHooks = [
@@ -1032,13 +1121,13 @@ export class App {
      * @returns This `App` instance for chaining.
      */
     use(hooks) {
-        // Wave 3 boot guards: refuse to start when the new hook layer is a
+        // Boot guards: refuse to start when the new hook layer is a
         // known-misconfigured security primitive in production. These checks
         // run synchronously at registration time so the developer sees the
         // failure during boot, not on first request.
         this.assertSecureHookConfig(hooks);
         // If the developer installs their own secureHeaders(), drop the
-        // Wave 2 auto-installed instance so the user's overrides win instead of
+        // auto-installed instance so the user's overrides win instead of
         // being shadowed (the auto one runs first and the per-header
         // "set only if absent" semantics mean the second installation would be
         // a silent no-op).
@@ -1052,7 +1141,7 @@ export class App {
         if (hooks[CORS_HOOK_MARKER] === true) {
             this.corsOriginAllows = corsOriginAllowsFromHooks(this.groupHooks);
         }
-        this.resetWave3BootGuardCache();
+        this.resetBootGuardCache();
         return this;
     }
     /**
@@ -1080,7 +1169,7 @@ export class App {
      * @returns This `App` instance for chaining.
      */
     /**
-     * Apply an ordered list of plugin extensions (Wave 6 item 10) to the
+     * Apply an ordered list of plugin extensions to the
      * group-level hook chain. Each extension's `handler` is wrapped into a
      * single-event {@link Hooks} bundle so subsequent route registrations
      * pick it up via the normal hook composition path.
@@ -1095,7 +1184,7 @@ export class App {
     decorate(key, value, opts = {}) {
         if (Object.prototype.hasOwnProperty.call(this.decorations, key) &&
             opts.override !== true) {
-            // Wave 6 item 9: namespace-protected decorators. Refuse to silently
+            // Namespace-protected decorators. Refuse to silently
             // shadow an existing decoration; emit a once-per-process warn naming
             // both decorators on the explicit-override path.
             throw new Error(`decorate(): key "${key}" is already decorated. ` +
@@ -1145,22 +1234,22 @@ export class App {
     /**
      * Encapsulated plugin registration (Fastify-style). Receives a child App;
      * routes/hooks declared on the child are scoped to the plugin by default
-     * (Wave 6 item 15 \u2014 encapsulation default `local`).
+     * (encapsulation default `local`).
      *
-     * Wave 6 (`0.24.0`) additions on the plugin descriptor object:
+     * Plugin descriptor object fields (since `0.24.0`):
      *
      * - `dependencies: string[]` \u2014 prerequisite plugin names; the framework
      *   refuses-to-boot at registration time when any declared dependency has
-     *   not been installed first (item 8).
+     *   not been installed first.
      * - `seed: string` \u2014 differentiator for parameterized instances of the
-     *   same plugin (item 16). Dedup key becomes `${name}#${seed}`.
+     *   same plugin. Dedup key becomes `${name}#${seed}`.
      * - `stateful: boolean` \u2014 when `true` AND `name` is absent AND the app is
      *   in production with `secureDefaults` on, registration refuses-to-boot
      *   so silent double-installs of global-state-mutating plugins are caught
-     *   loud (item 16).
+     *   loud.
      * - `extensions: [{ event, handler, before?, after? }]` \u2014 declarative
-     *   lifecycle-hook ordering with topological-sort + cycle detection
-     *   (item 10). Refuses-at-registration on cycles.
+     *   lifecycle-hook ordering with topological-sort + cycle detection.
+     *   Refuses-at-registration on cycles.
      */
     register(plugin, config = {}) {
         const fn = typeof plugin === "function" ? plugin : (plugin.register ?? (() => { }));
@@ -1187,7 +1276,7 @@ export class App {
             this.installedPlugins.add(dedupKey);
         }
         if (descriptor?.extensions && descriptor.extensions.length > 0) {
-            // Wave 6 item 10: topological sort with cycle detection.
+            // Topological sort with cycle detection.
             const ordered = topoSortExtensions(descriptor.extensions);
             this.applyExtensions(ordered);
         }
@@ -1292,7 +1381,7 @@ export class App {
         const response = await this.dispatch(request);
         // In-flight responses that finish during draining advertise
         // `Connection: close` so HTTP/1.1 load balancers stop re-using the
-        // socket for new requests. Wave 4 connection-draining.
+        // socket for new requests (connection-draining).
         if (this.draining && !response.headers.has("connection")) {
             response.headers.set("connection", "close");
         }
@@ -1323,7 +1412,7 @@ export class App {
                     "retry-after": "5",
                     // Tell HTTP/1.1 load balancers to close the keep-alive socket
                     // immediately so the next request lands on a healthy instance
-                    // rather than coming back to a dying one. Wave 4.
+                    // rather than coming back to a dying one.
                     connection: "close",
                 },
             });
@@ -1343,8 +1432,9 @@ export class App {
         let activeSendHook = globalHooks.onSend;
         try {
             assertNoDuplicateSingletonHeaders(request.headers);
+            assertNoReservedInternalHeaders(request.headers);
             this.assertTrustProxyConfigured(request);
-            this.assertWave3BootGuards();
+            this.assertBootGuards();
             await globalHooks.onRequest?.(request);
             const url = new URL(request.url);
             const method = request.method;
@@ -1463,7 +1553,7 @@ export class App {
                     onResponse: activeResponseHook,
                 }, stripFingerprint);
             }
-            // Wave 4 leftover: when the client has already disconnected, classify
+            // When the client has already disconnected, classify
             // the request at `disconnectStatusCode` (default 499) instead of
             // letting an AbortError bubble up as a generic 5xx. Logged at `info`
             // so disconnect storms do not look like service incidents.
@@ -1598,7 +1688,7 @@ export class App {
                 }
             }
         }
-        // Wave 4: kill idle keep-alive connections immediately so they cannot
+        // Kill idle keep-alive connections immediately so they cannot
         // be re-used for a new request that would race with the drain. Adapters
         // (Node) register a hook here. In-flight requests are unaffected.
         for (const hook of this.idleConnectionCloseHooks) {
@@ -1681,7 +1771,33 @@ function corsOriginAllowsFromHooks(layers) {
     return allows;
 }
 /**
- * Topological sort of plugin extensions (Wave 6 item 10). Refuses-at-call
+ * Detect header-mutating middleware on a WebSocket route's
+ * effective hook stack. Returns a list of human-readable names for any
+ * middleware that would otherwise lose its headers to the post-upgrade
+ * RFC 6455 frame stream.
+ * @internal
+ */
+function detectHeaderMutatingMiddleware(layers) {
+    const found = [];
+    for (const hooks of layers) {
+        const record = hooks;
+        // Skip the framework-default auto-secureHeaders bundle — it is
+        // installed by every App and only sets headers that are missing, so it
+        // never conflicts with a WebSocket upgrade in practice.
+        const isAuto = record[AUTO_SECURE_HEADERS_MARKER] === true;
+        if (!isAuto && record[SECURE_HEADERS_MARKER] === true)
+            found.push("secureHeaders()");
+        if (record[CORS_HOOK_MARKER] === true)
+            found.push("cors()");
+        if (record[CSRF_HOOK_MARKER] === true)
+            found.push("csrf()");
+        if (record[COMPRESSION_HOOK_MARKER] === true)
+            found.push("compression()");
+    }
+    return Array.from(new Set(found));
+}
+/**
+ * Topological sort of plugin extensions. Refuses-at-call
  * on cyclic ordering with a structured error naming the cycle.
  * @internal
  */
@@ -1734,6 +1850,39 @@ export function topoSortExtensions(exts) {
         const remaining = Array.from(byName.keys()).filter((n) => !out.some((e) => e.name === n));
         throw new Error(`Plugin extension cycle detected among: ${remaining.map((n) => JSON.stringify(n)).join(", ")}.`);
     }
+    // Refuse pairs of extensions that mutate the same response
+    // header without declaring a before/after ordering relative to each
+    // other. The resulting header value would otherwise depend on plugin
+    // registration order.
+    for (let i = 0; i < exts.length; i++) {
+        const a = exts[i];
+        const aHeaders = a.responseHeaders;
+        if (!aHeaders || aHeaders.length === 0)
+            continue;
+        const aSet = new Set(aHeaders.map((h) => h.toLowerCase()));
+        for (let j = i + 1; j < exts.length; j++) {
+            const b = exts[j];
+            const bHeaders = b.responseHeaders;
+            if (!bHeaders || bHeaders.length === 0)
+                continue;
+            const overlap = bHeaders
+                .map((h) => h.toLowerCase())
+                .filter((h) => aSet.has(h));
+            if (overlap.length === 0)
+                continue;
+            const declared = (a.before ?? []).includes(b.name) ||
+                (a.after ?? []).includes(b.name) ||
+                (b.before ?? []).includes(a.name) ||
+                (b.after ?? []).includes(a.name);
+            if (!declared) {
+                throw new Error(`Plugin extension header conflict: ${JSON.stringify(a.name)} and ` +
+                    `${JSON.stringify(b.name)} both mutate response header(s) ` +
+                    `${overlap.map((h) => JSON.stringify(h)).join(", ")} but neither ` +
+                    "declares a `before` or `after` relationship to the other. Add the " +
+                    "missing ordering to make the merged header value deterministic.");
+            }
+        }
+    }
     return out;
 }
 function securityMarkersFromHooks(layers) {
@@ -1925,6 +2074,12 @@ function headersToObject(h) {
 function queryToObject(s) {
     const o = {};
     for (const key of new Set(s.keys())) {
+        // Spring4Shell-style defense: never bind attacker-controlled keys named
+        // __proto__ / constructor / prototype as own properties on the parsed
+        // query object — they would survive downstream `{...query}` spreads and
+        // shallow merges. See isForbiddenObjectKey in src/security.ts.
+        if (isForbiddenObjectKey(key))
+            continue;
         const all = s.getAll(key);
         o[key] = all.length > 1 ? all : all[0];
     }
@@ -1947,7 +2102,16 @@ async function readBody(req, ct, limit, multipart) {
     }
     if (ct.includes("application/x-www-form-urlencoded")) {
         const bytes = await readBodyLimited(req, limit);
-        return Object.fromEntries(new URLSearchParams(new TextDecoder().decode(bytes)));
+        const params = new URLSearchParams(new TextDecoder().decode(bytes));
+        // Same Spring4Shell-class defense as queryToObject: Object.fromEntries
+        // would set __proto__ / constructor / prototype as own properties.
+        const out = {};
+        for (const [k, v] of params) {
+            if (isForbiddenObjectKey(k))
+                continue;
+            out[k] = v;
+        }
+        return out;
     }
     if (ct.includes("multipart/form-data")) {
         // Multipart: rely on platform parser, but enforce content-length first.
@@ -1972,6 +2136,12 @@ async function readBody(req, ct, limit, multipart) {
                     throw new PayloadTooLargeError(multipart.maxFileBytes);
                 }
             }
+            // Spring4Shell-class defense (see isForbiddenObjectKey): drop fields
+            // whose name would land on a prototype-pollution sink. They still count
+            // toward the maxFields / maxFiles limits above so an attacker can't use
+            // them to bypass DoS caps.
+            if (isForbiddenObjectKey(k))
+                return;
             out[k] = v;
         });
         if (multipart?.maxFields !== undefined && fields > multipart.maxFields) {