@infersec/conduit 1.86.0 → 1.86.1

package/dist/cli.sea.cjs

@@ -26930,7 +26930,13 @@ function requireRequest$2 () {
 	      } else if (typeof val[i] === 'object') {
 	        throw new InvalidArgumentError(`invalid ${key} header`)
 	      } else {
-	        arr.push(`${val[i]}`);
+	        // Coerce primitives (and reject unsafe coercions such as functions
+	        // with a crafted toString/Symbol.toPrimitive).
+	        const str = `${val[i]}`;
+	        if (!isValidHeaderValue(str)) {
+	          throw new InvalidArgumentError(`invalid ${key} header`)
+	        }
+	        arr.push(str);
 	      }
 	    }
 	    val = arr;
@@ -26941,7 +26947,12 @@ function requireRequest$2 () {
 	  } else if (val === null) {
 	    val = '';
 	  } else {
+	    // Coerce primitives (and reject unsafe coercions such as functions
+	    // with a crafted toString/Symbol.toPrimitive).
 	    val = `${val}`;
+	    if (!isValidHeaderValue(val)) {
+	      throw new InvalidArgumentError(`invalid ${key} header`)
+	    }
 	  }
 
 	  if (headerName === 'host') {
@@ -33423,6 +33434,7 @@ function requireClientH1 () {
 	  RequestContentLengthMismatchError,
 	  ResponseContentLengthMismatchError,
 	  RequestAbortedError,
+	  InvalidArgumentError,
 	  HeadersTimeoutError,
 	  HeadersOverflowError,
 	  SocketError,
@@ -34547,8 +34559,16 @@ function requireClientH1 () {
 	    }
 	    body = bodyStream.stream;
 	    contentLength = bodyStream.length;
-	  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-	    headers.push('content-type', body.type);
+	  } else if (util.isBlobLike(body) && request.contentType == null) {
+	    const contentType = body.type;
+	    if (contentType) {
+	      const contentTypeValue = `${contentType}`;
+	      if (!util.isValidHeaderValue(contentTypeValue)) {
+	        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'));
+	        return false
+	      }
+	      headers.push('content-type', contentTypeValue);
+	    }
 	  }
 
 	  if (body && typeof body.read === 'function') {
@@ -39259,6 +39279,26 @@ function requireRetryHandler () {
 	  return isNaN(retryTime) ? 0 : retryTime - Date.now()
 	}
 
+	function validatePartialResponseContentLength (headers, range, statusCode, retryCount) {
+	  const contentLength = headers['content-length'];
+	  if (contentLength == null) {
+	    return
+	  }
+
+	  if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
+	    return
+	  }
+
+	  const length = Number(contentLength);
+	  const expectedLength = range.end - range.start + 1;
+	  if (!Number.isFinite(length) || length !== expectedLength) {
+	    throw new RequestRetryError('Content-Length mismatch', statusCode, {
+	      headers,
+	      data: { count: retryCount }
+	    })
+	  }
+	}
+
 	class RetryHandler {
 	  constructor (opts, { dispatch, handler }) {
 	    const { retryOptions, ...dispatchOpts } = opts;
@@ -39473,6 +39513,8 @@ function requireRetryHandler () {
 	        })
 	      }
 
+	      validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount);
+
 	      const { start, size, end = size ? size - 1 : null } = contentRange;
 
 	      assert(this.start === start, 'content-range mismatch');
@@ -39497,6 +39539,8 @@ function requireRetryHandler () {
 	          return
 	        }
 
+	        validatePartialResponseContentLength(headers, range, statusCode, this.retryCount);
+
 	        const { start, size, end = size ? size - 1 : null } = range;
 	        assert(
 	          start != null && Number.isFinite(start),
@@ -45199,11 +45243,147 @@ function requireCache$2 () {
 	const {
 	  safeHTTPMethods,
 	  pathHasQueryOrFragment,
-	  hasSafeIterator
+	  hasSafeIterator,
+	  isValidHTTPToken
 	} = requireUtil$7();
 
 	const { serializePathWithQuery } = requireUtil$7();
 
+	const MAX_DELTA_SECONDS = 2147483647;
+	const RESTRICTIVE_DIRECTIVE_NAMES = ['no-store', 'private', 'no-cache'];
+	const kInvalidCacheControlDirectives = Symbol('invalid cache-control directives');
+
+	function trimOWS (value) {
+	  return value.replace(/^[\t ]+|[\t ]+$/g, '')
+	}
+
+	function arrayIncludes (array, value) {
+	  for (let i = 0; i < array.length; i++) {
+	    if (array[i] === value) {
+	      return true
+	    }
+	  }
+
+	  return false
+	}
+
+	function trimOWSStart (value) {
+	  return value.replace(/^[\t ]+/, '')
+	}
+
+	function trimOWSEnd (value) {
+	  return value.replace(/[\t ]+$/, '')
+	}
+
+	function findUnescapedQuote (value, start) {
+	  let escaped = false;
+	  for (let i = start; i < value.length; i++) {
+	    if (escaped) {
+	      escaped = false;
+	    } else if (value[i] === '\\') {
+	      escaped = true;
+	    } else if (value[i] === '"') {
+	      return i
+	    }
+	  }
+
+	  return -1
+	}
+
+	function splitCacheControlHeaderValue (value) {
+	  const directives = [];
+	  let start = 0;
+	  let quoteStart = -1;
+	  let inQuote = false;
+	  let escaped = false;
+
+	  for (let i = 0; i < value.length; i++) {
+	    if (inQuote) {
+	      if (escaped) {
+	        escaped = false;
+	      } else if (value[i] === '\\') {
+	        escaped = true;
+	      } else if (value[i] === '"') {
+	        inQuote = false;
+	        quoteStart = -1;
+	      }
+	    } else if (value[i] === '"') {
+	      inQuote = true;
+	      quoteStart = i;
+	    } else if (value[i] === ',') {
+	      directives.push({ value: value.substring(start, i), fromMalformedQuote: false });
+	      start = i + 1;
+	    }
+	  }
+
+	  if (!inQuote) {
+	    directives.push({ value: value.substring(start), fromMalformedQuote: false });
+	    return directives
+	  }
+
+	  const tail = value.substring(start);
+	  const quoteOffset = quoteStart - start;
+	  let tailStart = 0;
+	  for (let i = 0; i < tail.length; i++) {
+	    if (tail[i] === ',') {
+	      directives.push({
+	        value: tail.substring(tailStart, i),
+	        fromMalformedQuote: tailStart > quoteOffset
+	      });
+	      tailStart = i + 1;
+	    }
+	  }
+
+	  directives.push({
+	    value: tail.substring(tailStart),
+	    fromMalformedQuote: tailStart > quoteOffset
+	  });
+	  return directives
+	}
+
+	function markInvalidCacheControlDirective (directives, key) {
+	  let invalidDirectives = directives[kInvalidCacheControlDirectives];
+
+	  if (invalidDirectives === undefined) {
+	    invalidDirectives = new Set();
+	    Object.defineProperty(directives, kInvalidCacheControlDirectives, {
+	      value: invalidDirectives
+	    });
+	  }
+
+	  invalidDirectives.add(key);
+	}
+
+	function hasInvalidCacheControlDirective (directives, key) {
+	  return directives[kInvalidCacheControlDirectives]?.has(key) === true
+	}
+
+	function getMalformedRestrictiveDirectiveName (key) {
+	  for (const directiveName of RESTRICTIVE_DIRECTIVE_NAMES) {
+	    if (
+	      key.startsWith(directiveName) &&
+	      key.length > directiveName.length &&
+	      !isValidHTTPToken(key[directiveName.length])
+	    ) {
+	      return directiveName
+	    }
+	  }
+
+	  let tokenOnlyKey = '';
+	  let hasInvalidTokenChar = false;
+	  for (let i = 0; i < key.length; i++) {
+	    if (isValidHTTPToken(key[i])) {
+	      tokenOnlyKey += key[i];
+	    } else {
+	      hasInvalidTokenChar = true;
+	    }
+	  }
+
+	  if (hasInvalidTokenChar && arrayIncludes(RESTRICTIVE_DIRECTIVE_NAMES, tokenOnlyKey)) {
+	    return tokenOnlyKey
+	  }
+	}
+
 	/**
 	 * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
 	 */
@@ -45226,6 +45406,20 @@ function requireCache$2 () {
 	  }
 	}
 
+	function appendHeader (headers, key, val) {
+	  const headerName = key.toLowerCase();
+	  const current = headers[headerName];
+	  const values = Array.isArray(val) ? val : [val];
+
+	  if (current === undefined) {
+	    headers[headerName] = Array.isArray(val) ? val.slice() : val;
+	  } else if (Array.isArray(current)) {
+	    current.push(...values);
+	  } else {
+	    headers[headerName] = [current, ...values];
+	  }
+	}
+
 	/**
 	 * @param {Record<string, string[] | string>}
 	 * @returns {Record<string, string[] | string>}
@@ -45246,11 +45440,11 @@ function requireCache$2 () {
 	        if (typeof key !== 'string' || typeof val !== 'string') {
 	          throw new Error('opts.headers is not a valid header map')
 	        }
-	        headers[key.toLowerCase()] = val;
+	        appendHeader(headers, key, val);
 	      }
 	    } else {
 	      for (const key of Object.keys(opts.headers)) {
-	        headers[key.toLowerCase()] = opts.headers[key];
+	        appendHeader(headers, key, opts.headers[key]);
 	      }
 	    }
 	  } else {
@@ -45322,29 +45516,37 @@ function requireCache$2 () {
 	   * @type {import('../../types/cache-interceptor.d.ts').default.CacheControlDirectives}
 	   */
 	  const output = {};
+	  const invalidNumericDirectives = new Set();
+	  const invalidNoArgumentDirectives = new Set();
 
-	  let directives;
-	  if (Array.isArray(header)) {
-	    directives = [];
-
-	    for (const directive of header) {
-	      directives.push(...directive.split(','));
-	    }
-	  } else {
-	    directives = header.split(',');
-	  }
+	  const directives = splitCacheControlHeaderValue(Array.isArray(header) ? header.join(',') : header);
 
 	  for (let i = 0; i < directives.length; i++) {
-	    const directive = directives[i].toLowerCase();
+	    const directiveRecord = directives[i];
+	    const directive = directiveRecord.value.toLowerCase();
+	    const fromMalformedQuote = directiveRecord.fromMalformedQuote;
 	    const keyValueDelimiter = directive.indexOf('=');
 
 	    let key;
 	    let value;
+	    let keyHasTrailingWhitespace = false;
+	    let valueHasLeadingWhitespace = false;
 	    if (keyValueDelimiter !== -1) {
-	      key = directive.substring(0, keyValueDelimiter).trimStart();
-	      value = directive.substring(keyValueDelimiter + 1);
+	      const rawKey = directive.substring(0, keyValueDelimiter);
+	      const rawValue = directive.substring(keyValueDelimiter + 1);
+
+	      keyHasTrailingWhitespace = trimOWSEnd(rawKey) !== rawKey;
+	      valueHasLeadingWhitespace = trimOWSStart(rawValue) !== rawValue;
+	      key = trimOWS(rawKey);
+	      value = trimOWSStart(rawValue);
 	    } else {
-	      key = directive.trim();
+	      key = trimOWS(directive);
+	    }
+
+	    const malformedRestrictiveDirectiveName = getMalformedRestrictiveDirectiveName(key);
+	    if (malformedRestrictiveDirectiveName !== undefined) {
+	      output[malformedRestrictiveDirectiveName] = true;
+	      continue
 	    }
 
 	    switch (key) {
@@ -45354,7 +45556,14 @@ function requireCache$2 () {
 	      case 's-maxage':
 	      case 'stale-while-revalidate':
 	      case 'stale-if-error': {
-	        if (value === undefined || value[0] === ' ') {
+	        if (fromMalformedQuote || invalidNumericDirectives.has(key)) {
+	          continue
+	        }
+
+	        if (value === undefined || keyHasTrailingWhitespace || valueHasLeadingWhitespace) {
+	          delete output[key];
+	          invalidNumericDirectives.add(key);
+	          markInvalidCacheControlDirective(output, key);
 	          continue
 	        }
 
@@ -45366,22 +45575,37 @@ function requireCache$2 () {
 	          value = value.substring(1, value.length - 1);
 	        }
 
-	        const parsedValue = parseInt(value, 10);
-	        // eslint-disable-next-line no-self-compare
-	        if (parsedValue !== parsedValue) {
+	        if (!/^[0-9]+$/.test(value)) {
+	          delete output[key];
+	          invalidNumericDirectives.add(key);
+	          markInvalidCacheControlDirective(output, key);
 	          continue
 	        }
 
-	        if (key === 'max-age' && key in output && output[key] >= parsedValue) {
-	          continue
-	        }
+	        const parsedValue = Math.min(parseInt(value, 10), MAX_DELTA_SECONDS);
 
-	        output[key] = parsedValue;
+	        if (key === 'min-fresh') {
+	          if (!(key in output) || output[key] < parsedValue) {
+	            output[key] = parsedValue;
+	          }
+	        } else if (!(key in output) || output[key] > parsedValue) {
+	          output[key] = parsedValue;
+	        }
 
 	        break
 	      }
 	      case 'private':
 	      case 'no-cache': {
+	        if (fromMalformedQuote) {
+	          output[key] = true;
+	          break
+	        }
+
+	        if (value !== undefined && value.length === 0) {
+	          output[key] = true;
+	          break
+	        }
+
 	        if (value) {
 	          // The private and no-cache directives can be unqualified (aka just
 	          //  `private` or `no-cache`) or qualified (w/ a value). When they're
@@ -45389,45 +45613,64 @@ function requireCache$2 () {
 	          //  `no-cache="header1"`, or `no-cache="header1, header2"`
 	          // If we're given multiple headers, the comma messes us up since
 	          //  we split the full header by commas. So, let's loop through the
-	          //  remaining parts in front of us until we find one that ends in a
-	          //  quote. We can then just splice all of the parts in between the
-	          //  starting quote and the ending quote out of the directives array
-	          //  and continue parsing like normal.
+	          //  remaining parts in front of us until we find one that contains a
+	          //  closing quote. We can then skip the consumed quoted-list fragments and
+	          //  continue parsing like normal.
 	          // https://www.rfc-editor.org/rfc/rfc9111.html#name-no-cache-2
 	          if (value[0] === '"') {
 	            // Something like `no-cache="some-header"` OR `no-cache="some-header, another-header"`.
+	            value = trimOWSEnd(value);
 
-	            // Add the first header on and cut off the leading quote
-	            const headers = [value.substring(1)];
+	            let fieldList = '';
+	            let lastQuotedPart = i;
+	            let foundEndingQuote = false;
+	            const closingQuote = findUnescapedQuote(value, 1);
 
-	            let foundEndingQuote = value[value.length - 1] === '"';
-	            if (!foundEndingQuote) {
+	            if (closingQuote !== -1) {
+	              fieldList = value.substring(1, closingQuote);
+	              foundEndingQuote = true;
+	            } else {
 	              // Something like `no-cache="some-header, another-header"`
 	              //  This can still be something invalid, e.g. `no-cache="some-header, ...`
+	              const fieldListParts = [value.substring(1)];
+
 	              for (let j = i + 1; j < directives.length; j++) {
-	                const nextPart = directives[j];
-	                const nextPartLength = nextPart.length;
+	                const nextPart = trimOWS(directives[j].value);
+	                const closingQuote = findUnescapedQuote(nextPart, 0);
 
-	                headers.push(nextPart.trim());
+	                lastQuotedPart = j;
 
-	                if (nextPartLength !== 0 && nextPart[nextPartLength - 1] === '"') {
+	                if (closingQuote !== -1) {
+	                  fieldListParts.push(nextPart.substring(0, closingQuote));
 	                  foundEndingQuote = true;
 	                  break
 	                }
+
+	                fieldListParts.push(nextPart);
 	              }
+
+	              fieldList = fieldListParts.join(',');
 	            }
 
-	            if (foundEndingQuote) {
-	              let lastHeader = headers[headers.length - 1];
-	              if (lastHeader[lastHeader.length - 1] === '"') {
-	                lastHeader = lastHeader.substring(0, lastHeader.length - 1);
-	                headers[headers.length - 1] = lastHeader;
-	              }
+	            if (!foundEndingQuote) {
+	              output[key] = true;
+	              break
+	            }
 
-	              for (let j = 0; j < headers.length; j++) {
-	                headers[j] = headers[j].trim();
+	            i = lastQuotedPart;
+
+	            const headers = fieldList.split(',');
+	            let validFieldNames = true;
+	            for (let j = 0; j < headers.length; j++) {
+	              headers[j] = trimOWS(headers[j]);
+	              if (!isValidHTTPToken(headers[j])) {
+	                validFieldNames = false;
 	              }
+	            }
 
+	            if (!validFieldNames) {
+	              output[key] = true;
+	            } else if (output[key] !== true) {
 	              if (key in output) {
 	                output[key] = output[key].concat(headers);
 	              } else {
@@ -45435,13 +45678,17 @@ function requireCache$2 () {
 	              }
 	            }
 	          } else {
-	            // Something like `no-cache="some-header"`
-	            const fieldName = value.trim();
+	            // Something like `no-cache=some-header`
+	            const fieldName = trimOWS(value);
 
-	            if (key in output) {
-	              output[key] = output[key].concat(fieldName);
-	            } else {
-	              output[key] = [fieldName];
+	            if (!isValidHTTPToken(fieldName)) {
+	              output[key] = true;
+	            } else if (output[key] !== true) {
+	              if (key in output) {
+	                output[key] = output[key].concat(fieldName);
+	              } else {
+	                output[key] = [fieldName];
+	              }
 	            }
 	          }
 
@@ -45450,19 +45697,27 @@ function requireCache$2 () {
 	      }
 	      // eslint-disable-next-line no-fallthrough
 	      case 'public':
-	      case 'no-store':
 	      case 'must-revalidate':
 	      case 'proxy-revalidate':
 	      case 'immutable':
 	      case 'no-transform':
 	      case 'must-understand':
 	      case 'only-if-cached':
-	        if (value) {
+	        if (fromMalformedQuote || invalidNoArgumentDirectives.has(key)) {
+	          continue
+	        }
+
+	        if (value !== undefined) {
 	          // These are qualified (something like `public=...`) when they aren't
-	          //  allowed to be, skip
+	          //  allowed to be, skip all instances of the malformed directive.
+	          delete output[key];
+	          invalidNoArgumentDirectives.add(key);
 	          continue
 	        }
 
+	        output[key] = true;
+	        break
+	      case 'no-store':
 	        output[key] = true;
 	        break
 	      default:
@@ -45474,31 +45729,79 @@ function requireCache$2 () {
 	  return output
 	}
 
+	/**
+	 * @param {string | string[]} varyHeader Vary header from the server
+	 * @returns {string[]}
+	 */
+	function splitVaryHeader (varyHeader) {
+	  const values = Array.isArray(varyHeader) ? varyHeader : [varyHeader];
+	  const output = [];
+
+	  for (let i = 0; i < values.length; i++) {
+	    const parts = values[i].split(',');
+	    for (let j = 0; j < parts.length; j++) {
+	      output.push(parts[j]);
+	    }
+	  }
+
+	  return output
+	}
+
+	/**
+	 * @param {string | string[]} varyHeader Vary header from the server
+	 * @returns {boolean}
+	 */
+	function hasVaryStar (varyHeader) {
+	  const values = splitVaryHeader(varyHeader);
+	  for (let i = 0; i < values.length; i++) {
+	    if (trimOWS(values[i]).indexOf('*') !== -1) {
+	      return true
+	    }
+	  }
+
+	  return false
+	}
+
 	/**
 	 * @param {string | string[]} varyHeader Vary header from the server
 	 * @param {Record<string, string | string[]>} headers Request headers
-	 * @returns {Record<string, string | string[]>}
+	 * @returns {Record<string, string | string[] | null> | undefined}
 	 */
 	function parseVaryHeader (varyHeader, headers) {
-	  if (typeof varyHeader === 'string' && varyHeader.includes('*')) {
+	  if (hasVaryStar(varyHeader)) {
 	    return headers
 	  }
 
 	  const output = /** @type {Record<string, string | string[] | null>} */ ({});
 
-	  const varyingHeaders = typeof varyHeader === 'string'
-	    ? varyHeader.split(',')
-	    : varyHeader;
+	  const varyingHeaders = splitVaryHeader(varyHeader);
 
 	  for (const header of varyingHeaders) {
-	    const trimmedHeader = header.trim().toLowerCase();
+	    const trimmedHeader = trimOWS(header).toLowerCase();
+
+	    if (trimmedHeader.length === 0) {
+	      continue
+	    }
+
+	    if (!isValidHTTPToken(trimmedHeader)) {
+	      return undefined
+	    }
 
-	    output[trimmedHeader] = headers[trimmedHeader] ?? null;
+	    const headerValue = headers[trimmedHeader];
+	    output[trimmedHeader] = Array.isArray(headerValue) ? headerValue.slice() : headerValue ?? null;
 	  }
 
 	  return output
 	}
 
+	/**
+	 * @param {string | string[]} varyHeader Vary header from the server
+	 * @returns {boolean}
+	 */
+	function isInvalidOrWildcardVaryHeader (varyHeader) {
+	  return hasVaryStar(varyHeader) || parseVaryHeader(varyHeader, {}) === undefined
+	}
+
 	/**
 	 * Note: this deviates from the spec a little. Empty etags ("", W/"") are valid,
 	 *  however, including them in cached resposnes serves little to no purpose.
@@ -45562,7 +45865,7 @@ function requireCache$2 () {
 	  }
 
 	  for (const method of methods) {
-	    if (!safeHTTPMethods.includes(method)) {
+	    if (!arrayIncludes(safeHTTPMethods, method)) {
 	      throw new TypeError(`element of ${name}-array needs to be one of following values: ${safeHTTPMethods.join(', ')}, got ${method}`)
 	    }
 	  }
@@ -45602,7 +45905,10 @@ function requireCache$2 () {
 	  assertCacheKey,
 	  assertCacheValue,
 	  parseCacheControlHeader,
+	  hasInvalidCacheControlDirective,
 	  parseVaryHeader,
+	  hasVaryStar,
+	  isInvalidOrWildcardVaryHeader,
 	  isEtagUsable,
 	  assertCacheMethods,
 	  assertCacheStore,
@@ -45636,6 +45942,26 @@ function requireDate () {
 	  }
 	}
 
+	function makeDate (year, monthIdx, day, hour, minute, second, weekday) {
+	  const result = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
+
+	  // Date.UTC treats years 0-99 as 1900-1999. Reset the full year so component
+	  // checks below validate the HTTP date as written.
+	  if (year >= 0 && year <= 99) {
+	    result.setUTCFullYear(year);
+	  }
+
+	  return result.getUTCFullYear() === year &&
+	    result.getUTCMonth() === monthIdx &&
+	    result.getUTCDate() === day &&
+	    result.getUTCHours() === hour &&
+	    result.getUTCMinutes() === minute &&
+	    result.getUTCSeconds() === second &&
+	    result.getUTCDay() === weekday
+	    ? result
+	    : undefined
+	}
+
 	/**
 	 * @see https://httpwg.org/specs/rfc9110.html#preferred.date.format
 	 *
@@ -45842,8 +46168,7 @@ function requireDate () {
 	    second = (code1 - 48) * 10 + (code2 - 48); // Convert ASCII codes to number
 	  }
 
-	  const result = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
-	  return result.getUTCDay() === weekday ? result : undefined
+	  return makeDate(year, monthIdx, day, hour, minute, second, weekday)
 	}
 
 	/**
@@ -46047,8 +46372,7 @@ function requireDate () {
 	  }
 	  const year = (yearDigit1 - 48) * 1000 + (yearDigit2 - 48) * 100 + (yearDigit3 - 48) * 10 + (yearDigit4 - 48);
 
-	  const result = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
-	  return result.getUTCDay() === weekday ? result : undefined
+	  return makeDate(year, monthIdx, day, hour, minute, second, weekday)
 	}
 
 	/**
@@ -46262,8 +46586,7 @@ function requireDate () {
 	    second = (code1 - 48) * 10 + (code2 - 48); // Convert ASCII codes to number
 	  }
 
-	  const result = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
-	  return result.getUTCDay() === weekday ? result : undefined
+	  return makeDate(year, monthIdx, day, hour, minute, second, weekday)
 	}
 
 	date = {
@@ -46282,7 +46605,10 @@ function requireCacheHandler () {
 	const util = requireUtil$7();
 	const {
 	  parseCacheControlHeader,
+	  hasInvalidCacheControlDirective,
 	  parseVaryHeader,
+	  hasVaryStar,
+	  isInvalidOrWildcardVaryHeader,
 	  isEtagUsable
 	} = requireCache$2();
 	const { parseHttpDate } = requireDate();
@@ -46305,6 +46631,92 @@ function requireCacheHandler () {
 
 	const MAX_RESPONSE_AGE = 2147483647000;
 
+	function trimOWS (value) {
+	  return value.replace(/^[\t ]+|[\t ]+$/g, '')
+	}
+
+	function arrayIncludes (array, value) {
+	  for (let i = 0; i < array.length; i++) {
+	    if (array[i] === value) {
+	      return true
+	    }
+	  }
+
+	  return false
+	}
+
+	function appendConnectionHeaderTokens (headersToRemove, connectionHeader) {
+	  const values = Array.isArray(connectionHeader) ? connectionHeader : [connectionHeader];
+
+	  for (let i = 0; i < values.length; i++) {
+	    const tokens = values[i].split(',');
+	    for (let j = 0; j < tokens.length; j++) {
+	      headersToRemove.push(trimOWS(tokens[j]).toLowerCase());
+	    }
+	  }
+	}
+
+	function getSameOriginPath (cacheKey, location) {
+	  if (typeof location !== 'string') {
+	    return undefined
+	  }
+
+	  let originUrl;
+	  let requestUrl;
+	  let locationUrl;
+	  try {
+	    originUrl = new URL(cacheKey.origin);
+	    requestUrl = new URL(cacheKey.path, originUrl);
+	    locationUrl = new URL(location, requestUrl);
+	  } catch {
+	    return undefined
+	  }
+
+	  if (locationUrl.origin !== originUrl.origin) {
+	    return undefined
+	  }
+
+	  return locationUrl.pathname + locationUrl.search
+	}
+
+	function deleteCachedUri (store, cacheKey, path) {
+	  deleteCachedValue(store, {
+	    ...cacheKey,
+	    path
+	  });
+
+	  for (let i = 0; i < util.safeHTTPMethods.length; i++) {
+	    const method = util.safeHTTPMethods[i];
+	    if (method !== cacheKey.method) {
+	      deleteCachedValue(store, {
+	        ...cacheKey,
+	        method,
+	        path
+	      });
+	    }
+	  }
+	}
+
+	function deleteLocationTargets (store, cacheKey, headerValue) {
+	  if (headerValue === undefined) {
+	    return
+	  }
+
+	  const values = Array.isArray(headerValue) ? headerValue : [headerValue];
+	  for (let i = 0; i < values.length; i++) {
+	    const path = getSameOriginPath(cacheKey, values[i]);
+	    if (path !== undefined) {
+	      deleteCachedUri(store, cacheKey, path);
+	    }
+	  }
+	}
+
+	function invalidateUnsafeRequest (store, cacheKey, resHeaders) {
+	  deleteCachedUri(store, cacheKey, cacheKey.path);
+	  deleteLocationTargets(store, cacheKey, resHeaders.location);
+	  deleteLocationTargets(store, cacheKey, resHeaders['content-location']);
+	}
+
 	/**
 	 * @typedef {import('../../types/dispatcher.d.ts').default.DispatchHandler} DispatchHandler
 	 *
@@ -46386,28 +46798,28 @@ function requireCacheHandler () {
 	    const handler = this;
 
 	    if (
-	      !util.safeHTTPMethods.includes(this.#cacheKey.method) &&
+	      !arrayIncludes(util.safeHTTPMethods, this.#cacheKey.method) &&
 	      statusCode >= 200 &&
 	      statusCode <= 399
 	    ) {
 	      // Successful response to an unsafe method, delete it from cache
 	      //  https://www.rfc-editor.org/rfc/rfc9111.html#name-invalidating-stored-response
-	      try {
-	        this.#store.delete(this.#cacheKey)?.catch?.(noop);
-	      } catch {
-	        // Fail silently
-	      }
+	      invalidateUnsafeRequest(this.#store, this.#cacheKey, resHeaders);
 	      return downstreamOnHeaders()
 	    }
 
 	    const cacheControlHeader = resHeaders['cache-control'];
-	    const heuristicallyCacheable = resHeaders['last-modified'] && HEURISTICALLY_CACHEABLE_STATUS_CODES.includes(statusCode);
+	    const heuristicallyCacheable = resHeaders['last-modified'] && arrayIncludes(HEURISTICALLY_CACHEABLE_STATUS_CODES, statusCode);
 	    if (
 	      !cacheControlHeader &&
 	      !resHeaders['expires'] &&
 	      !heuristicallyCacheable &&
 	      !this.#cacheByDefault
 	    ) {
+	      if (statusCode === 304 && resHeaders.vary && isInvalidOrWildcardVaryHeader(resHeaders.vary)) {
+	        deleteCachedValue(this.#store, this.#cacheKey);
+	      }
+
 	      // Don't have anything to tell us this response is cachable and we're not
 	      //  caching by default
 	      return downstreamOnHeaders()
@@ -46415,31 +46827,46 @@ function requireCacheHandler () {
 
 	    const cacheControlDirectives = cacheControlHeader ? parseCacheControlHeader(cacheControlHeader) : {};
 	    if (!canCacheResponse(this.#cacheType, statusCode, resHeaders, cacheControlDirectives, this.#cacheKey.headers)) {
+	      if (statusCode === 304 && (cacheControlHeader || revalidationResponseDisallowsCachedReuse(this.#cacheType, resHeaders, cacheControlDirectives))) {
+	        deleteCachedValue(this.#store, this.#cacheKey);
+	      }
+
 	      return downstreamOnHeaders()
 	    }
 
 	    const now = Date.now();
-	    const resAge = resHeaders.age ? getAge(resHeaders.age) : undefined;
-	    if (resAge && resAge >= MAX_RESPONSE_AGE) {
+	    const resAge = Object.hasOwn(resHeaders, 'age') ? getAge(resHeaders.age) : undefined;
+	    if (resAge !== undefined && resAge >= MAX_RESPONSE_AGE) {
 	      // Response considered stale
+	      deleteCachedValueIfNotModified(statusCode, this.#store, this.#cacheKey);
 	      return downstreamOnHeaders()
 	    }
 
-	    const resDate = typeof resHeaders.date === 'string'
-	      ? parseHttpDate(resHeaders.date)
-	      : undefined;
+	    const resDate = Object.hasOwn(resHeaders, 'date') ? getDate(resHeaders.date) : undefined;
+	    if (resDate === null) {
+	      deleteCachedValueIfNotModified(statusCode, this.#store, this.#cacheKey);
+	      return downstreamOnHeaders()
+	    }
+
+	    const apparentAge = resDate ? Math.max(0, now - resDate.getTime()) : 0;
+	    const currentAge = Math.max(apparentAge, resAge ?? 0);
 
 	    const staleAt =
 	      determineStaleAt(this.#cacheType, now, resAge, resHeaders, resDate, cacheControlDirectives) ??
 	      this.#cacheByDefault;
-	    if (staleAt === undefined || (resAge && resAge > staleAt)) {
+	    if (staleAt === undefined || currentAge >= staleAt) {
+	      if (cacheControlHeader || staleAt !== undefined) {
+	        deleteCachedValueIfNotModified(statusCode, this.#store, this.#cacheKey);
+	      }
+
 	      return downstreamOnHeaders()
 	    }
 
-	    const baseTime = resDate ? resDate.getTime() : now;
+	    const baseTime = now - currentAge;
 	    const absoluteStaleAt = staleAt + baseTime;
 	    if (now >= absoluteStaleAt) {
 	      // Response is already stale
+	      deleteCachedValueIfNotModified(statusCode, this.#store, this.#cacheKey);
 	      return downstreamOnHeaders()
 	    }
 
@@ -46452,7 +46879,8 @@ function requireCacheHandler () {
 	      }
 	    }
 
-	    const deleteAt = determineDeleteAt(baseTime, cacheControlDirectives, absoluteStaleAt);
+	    const cachedAt = baseTime;
+	    const deleteAt = determineDeleteAt(baseTime, now, cacheControlDirectives, absoluteStaleAt);
 	    const strippedHeaders = stripNecessaryHeaders(resHeaders, cacheControlDirectives);
 
 	    /**
@@ -46464,7 +46892,7 @@ function requireCacheHandler () {
 	      headers: strippedHeaders,
 	      vary: varyDirectives,
 	      cacheControlDirectives,
-	      cachedAt: resAge ? now - resAge : now,
+	      cachedAt,
 	      staleAt: absoluteStaleAt,
 	      deleteAt
 	    };
@@ -46482,6 +46910,7 @@ function requireCacheHandler () {
 	        value.statusCode = cachedValue.statusCode;
 	        value.statusMessage = cachedValue.statusMessage;
 	        value.etag = cachedValue.etag;
+	        value.vary = varyDirectives ?? cachedValue.vary;
 	        value.headers = { ...cachedValue.headers, ...strippedHeaders };
 
 	        downstreamOnHeaders();
@@ -46612,6 +47041,36 @@ function requireCacheHandler () {
 	  }
 	}
 
+	/**
+	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheStore} store
+	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} cacheKey
+	 */
+	function deleteCachedValue (store, cacheKey) {
+	  try {
+	    store.delete(cacheKey)?.catch?.(noop);
+	  } catch {
+	    // Fail silently
+	  }
+	}
+
+	function deleteCachedValueIfNotModified (statusCode, store, cacheKey) {
+	  if (statusCode === 304) {
+	    deleteCachedValue(store, cacheKey);
+	  }
+	}
+
+	/**
+	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheOptions['type']} cacheType
+	 * @param {import('../../types/header.d.ts').IncomingHttpHeaders} resHeaders
+	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheControlDirectives} cacheControlDirectives
+	 * @returns {boolean}
+	 */
+	function revalidationResponseDisallowsCachedReuse (cacheType, resHeaders, cacheControlDirectives) {
+	  return cacheControlDirectives['no-store'] === true ||
+	    (cacheType === 'shared' && cacheControlDirectives.private === true) ||
+	    (resHeaders.vary ? isInvalidOrWildcardVaryHeader(resHeaders.vary) : false)
+	}
+
 	/**
 	 * @see https://www.rfc-editor.org/rfc/rfc9111.html#name-storing-responses-to-authen
 	 *
@@ -46623,12 +47082,12 @@ function requireCacheHandler () {
 	 */
 	function canCacheResponse (cacheType, statusCode, resHeaders, cacheControlDirectives, reqHeaders) {
 	  // Status code must be final and understood.
-	  if (statusCode < 200 || NOT_UNDERSTOOD_STATUS_CODES.includes(statusCode)) {
+	  if (statusCode < 200 || arrayIncludes(NOT_UNDERSTOOD_STATUS_CODES, statusCode)) {
 	    return false
 	  }
 	  // Responses with neither status codes that are heuristically cacheable, nor "explicit enough" caching
 	  // directives, are not cacheable. "Explicit enough": see https://www.rfc-editor.org/rfc/rfc9111.html#section-3
-	  if (!HEURISTICALLY_CACHEABLE_STATUS_CODES.includes(statusCode) && !resHeaders['expires'] &&
+	  if (!arrayIncludes(HEURISTICALLY_CACHEABLE_STATUS_CODES, statusCode) && !resHeaders['expires'] &&
 	    !cacheControlDirectives.public &&
 	    cacheControlDirectives['max-age'] === undefined &&
 	    // RFC 9111: a private response directive, if the cache is not shared
@@ -46647,12 +47106,12 @@ function requireCacheHandler () {
 	  }
 
 	  // https://www.rfc-editor.org/rfc/rfc9111.html#section-4.1-5
-	  if (resHeaders.vary?.includes('*')) {
+	  if (resHeaders.vary && hasVaryStar(resHeaders.vary)) {
 	    return false
 	  }
 
 	  // https://www.rfc-editor.org/rfc/rfc9111.html#name-storing-responses-to-authen
-	  if (reqHeaders?.authorization) {
+	  if (reqHeaders != null && Object.hasOwn(reqHeaders, 'authorization')) {
 	    if (
 	      !cacheControlDirectives.public &&
 	      !cacheControlDirectives['s-maxage'] &&
@@ -46667,14 +47126,14 @@ function requireCacheHandler () {
 
 	    if (
 	      Array.isArray(cacheControlDirectives['no-cache']) &&
-	      cacheControlDirectives['no-cache'].includes('authorization')
+	      arrayIncludes(cacheControlDirectives['no-cache'], 'authorization')
 	    ) {
 	      return false
 	    }
 
 	    if (
 	      Array.isArray(cacheControlDirectives['private']) &&
-	      cacheControlDirectives['private'].includes('authorization')
+	      arrayIncludes(cacheControlDirectives['private'], 'authorization')
 	    ) {
 	      return false
 	    }
@@ -46683,14 +47142,51 @@ function requireCacheHandler () {
 	  return true
 	}
 
+	/**
+	 * @param {string | string[]} dateHeader
+	 * @returns {Date | null | undefined}
+	 */
+	function getDate (dateHeader) {
+	  let dateValue = dateHeader;
+	  if (Array.isArray(dateValue)) {
+	    if (dateValue.length !== 1) {
+	      return null
+	    }
+
+	    dateValue = dateValue[0];
+	  }
+
+	  if (typeof dateValue !== 'string') {
+	    return null
+	  }
+
+	  return parseHttpDate(dateValue)
+	}
+
 	/**
 	 * @param {string | string[]} ageHeader
 	 * @returns {number | undefined}
 	 */
 	function getAge (ageHeader) {
-	  const age = parseInt(Array.isArray(ageHeader) ? ageHeader[0] : ageHeader);
+	  let ageValue = ageHeader;
+	  if (Array.isArray(ageValue)) {
+	    if (ageValue.length !== 1) {
+	      return MAX_RESPONSE_AGE
+	    }
+
+	    ageValue = ageValue[0];
+	  }
+
+	  if (typeof ageValue !== 'string' || !/^[\t ]*[0-9]+[\t ]*$/.test(ageValue)) {
+	    return MAX_RESPONSE_AGE
+	  }
+
+	  const age = BigInt(ageValue.replace(/^[\t ]+|[\t ]+$/g, ''));
+	  if (age >= BigInt(MAX_RESPONSE_AGE / 1000)) {
+	    return MAX_RESPONSE_AGE
+	  }
 
-	  return isNaN(age) ? undefined : age * 1000
+	  return Number(age) * 1000
 	}
 
 	/**
@@ -46708,43 +47204,60 @@ function requireCacheHandler () {
 	    // Prioritize s-maxage since we're a shared cache
 	    //  s-maxage > max-age > Expire
 	    //  https://www.rfc-editor.org/rfc/rfc9111.html#section-5.2.2.10-3
+	    if (hasInvalidCacheControlDirective(cacheControlDirectives, 's-maxage')) {
+	      return 0
+	    }
+
 	    const sMaxAge = cacheControlDirectives['s-maxage'];
 	    if (sMaxAge !== undefined) {
-	      return sMaxAge > 0 ? sMaxAge * 1000 : undefined
+	      return sMaxAge * 1000
 	    }
 	  }
 
+	  if (hasInvalidCacheControlDirective(cacheControlDirectives, 'max-age')) {
+	    return 0
+	  }
+
 	  const maxAge = cacheControlDirectives['max-age'];
 	  if (maxAge !== undefined) {
-	    return maxAge > 0 ? maxAge * 1000 : undefined
+	    return maxAge * 1000
 	  }
 
-	  if (typeof resHeaders.expires === 'string') {
+	  if (Object.hasOwn(resHeaders, 'expires')) {
 	    // https://www.rfc-editor.org/rfc/rfc9111.html#section-5.3
+	    if (typeof resHeaders.expires !== 'string') {
+	      return 0
+	    }
+
 	    const expiresDate = parseHttpDate(resHeaders.expires);
-	    if (expiresDate) {
-	      if (now >= expiresDate.getTime()) {
-	        return undefined
-	      }
+	    if (!expiresDate) {
+	      return 0
+	    }
 
-	      if (responseDate) {
-	        if (responseDate >= expiresDate) {
-	          return undefined
-	        }
+	    if (now >= expiresDate.getTime()) {
+	      return 0
+	    }
 
-	        if (age !== undefined && age > (expiresDate - responseDate)) {
-	          return undefined
-	        }
+	    if (responseDate) {
+	      if (responseDate >= expiresDate) {
+	        return 0
+	      }
+
+	      const freshnessLifetime = expiresDate.getTime() - responseDate.getTime();
+	      if (age !== undefined && age >= freshnessLifetime) {
+	        return 0
 	      }
 
-	      return expiresDate.getTime() - now
+	      return freshnessLifetime
 	    }
+
+	    return expiresDate.getTime() - now
 	  }
 
 	  if (typeof resHeaders['last-modified'] === 'string') {
 	    // https://www.rfc-editor.org/rfc/rfc9111.html#name-calculating-heuristic-fresh
-	    const lastModified = new Date(resHeaders['last-modified']);
-	    if (isValidDate(lastModified)) {
+	    const lastModified = parseHttpDate(resHeaders['last-modified']);
+	    if (lastModified) {
 	      if (lastModified.getTime() >= now) {
 	        return undefined
 	      }
@@ -46757,18 +47270,19 @@ function requireCacheHandler () {
 
 	  if (cacheControlDirectives.immutable) {
 	    // https://www.rfc-editor.org/rfc/rfc8246.html#section-2.2
-	    return 31536000
+	    return 31536000000
 	  }
 
 	  return undefined
 	}
 
 	/**
-	 * @param {number} now
+	 * @param {number} baseTime
+	 * @param {number} cachedAt
 	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheControlDirectives} cacheControlDirectives
 	 * @param {number} staleAt
 	 */
-	function determineDeleteAt (now, cacheControlDirectives, staleAt) {
+	function determineDeleteAt (baseTime, cachedAt, cacheControlDirectives, staleAt) {
 	  let staleWhileRevalidate = -Infinity;
 	  let staleIfError = -Infinity;
 	  let immutable = -Infinity;
@@ -46782,15 +47296,21 @@ function requireCacheHandler () {
 	  }
 
 	  if (cacheControlDirectives.immutable && staleWhileRevalidate === -Infinity && staleIfError === -Infinity) {
-	    immutable = now + 31536000000;
+	    immutable = cachedAt + 31536000000;
 	  }
 
 	  // When no stale directives or immutable flag, add a revalidation buffer
 	  // equal to the freshness lifetime so the entry survives past staleAt long
 	  // enough to be revalidated instead of silently disappearing.
+	  //
+	  // Response Date headers only have second precision, so baseTime can trail the
+	  // actual cache insertion time by up to ~1s. Pad the buffer by that bounded
+	  // skew so short-lived entries do not disappear exactly when they should be
+	  // revalidated.
 	  if (staleWhileRevalidate === -Infinity && staleIfError === -Infinity && immutable === -Infinity) {
-	    const freshnessLifetime = staleAt - now;
-	    return staleAt + freshnessLifetime
+	    const freshnessLifetime = staleAt - baseTime;
+	    const datePrecisionPadding = Math.min(Math.max(cachedAt - baseTime, 0), 1000);
+	    return staleAt + freshnessLifetime + datePrecisionPadding
 	  }
 
 	  return Math.max(staleAt, staleWhileRevalidate, staleIfError, immutable)
@@ -46817,14 +47337,7 @@ function requireCacheHandler () {
 	  ];
 
 	  if (resHeaders['connection']) {
-	    if (Array.isArray(resHeaders['connection'])) {
-	      // connection: a
-	      // connection: b
-	      headersToRemove.push(...resHeaders['connection'].map(header => header.trim()));
-	    } else {
-	      // connection: a, b
-	      headersToRemove.push(...resHeaders['connection'].split(',').map(header => header.trim()));
-	    }
+	    appendConnectionHeaderTokens(headersToRemove, resHeaders['connection']);
 	  }
 
 	  if (Array.isArray(cacheControlDirectives['no-cache'])) {
@@ -46837,7 +47350,7 @@ function requireCacheHandler () {
 
 	  let strippedHeaders;
 	  for (const headerName of headersToRemove) {
-	    if (resHeaders[headerName]) {
+	    if (Object.hasOwn(resHeaders, headerName)) {
 	      strippedHeaders ??= { ...resHeaders };
 	      delete strippedHeaders[headerName];
 	    }
@@ -46846,14 +47359,6 @@ function requireCacheHandler () {
 	  return strippedHeaders ?? resHeaders
 	}
 
-	/**
-	 * @param {Date} date
-	 * @returns {boolean}
-	 */
-	function isValidDate (date) {
-	  return date instanceof Date && Number.isFinite(date.valueOf())
-	}
-
 	cacheHandler = CacheHandler;
 	return cacheHandler;
 }
@@ -47083,17 +47588,62 @@ function requireMemoryCacheStore () {
 	}
 
 	function findEntry (key, entries, now) {
-	  return entries.find((entry) => (
-	    entry.deleteAt > now &&
-	    entry.method === key.method &&
-	    (entry.vary == null || Object.keys(entry.vary).every(headerName => {
-	      if (entry.vary[headerName] === null) {
-	        return key.headers[headerName] === undefined
+	  for (let i = 0; i < entries.length; i++) {
+	    const entry = entries[i];
+	    if (
+	      entry.deleteAt > now &&
+	      entry.method === key.method &&
+	      varyMatches(key, entry)
+	    ) {
+	      return entry
+	    }
+	  }
+	}
+
+	function varyMatches (key, entry) {
+	  if (entry.vary == null) {
+	    return true
+	  }
+
+	  for (const headerName in entry.vary) {
+	    if (Object.hasOwn(entry.vary, headerName) && !headerValueEquals(key.headers?.[headerName], entry.vary[headerName])) {
+	      return false
+	    }
+	  }
+
+	  return true
+	}
+
+	/**
+	 * @param {string|string[]|null|undefined} lhs
+	 * @param {string|string[]|null|undefined} rhs
+	 * @returns {boolean}
+	 */
+	function headerValueEquals (lhs, rhs) {
+	  if (lhs == null && rhs == null) {
+	    return true
+	  }
+
+	  if ((lhs == null && rhs != null) ||
+	      (lhs != null && rhs == null)) {
+	    return false
+	  }
+
+	  if (Array.isArray(lhs) && Array.isArray(rhs)) {
+	    if (lhs.length !== rhs.length) {
+	      return false
+	    }
+
+	    for (let i = 0; i < lhs.length; i++) {
+	      if (lhs[i] !== rhs[i]) {
+	        return false
 	      }
+	    }
 
-	      return entry.vary[headerName] === key.headers[headerName]
-	    }))
-	  ))
+	    return true
+	  }
+
+	  return lhs === rhs
 	}
 
 	memoryCacheStore = MemoryCacheStore;
@@ -47126,7 +47676,7 @@ function requireCacheRevalidationHandler () {
 	  #successful = false
 
 	  /**
-	   * @type {((boolean, any) => void) | null}
+	   * @type {((success: boolean, context?: any, statusCode?: number, headers?: import('../../types/header.d.ts').IncomingHttpHeaders) => void) | null}
 	   */
 	  #callback
 
@@ -47143,7 +47693,7 @@ function requireCacheRevalidationHandler () {
 	  #allowErrorStatusCodes
 
 	  /**
-	   * @param {(boolean) => void} callback Function to call if the cached value is valid
+	   * @param {(success: boolean, context?: any, statusCode?: number, headers?: import('../../types/header.d.ts').IncomingHttpHeaders) => void} callback Function to call if the cached value is valid
 	   * @param {import('../../types/dispatcher.d.ts').default.DispatchHandlers} handler
 	   * @param {boolean} allowErrorStatusCodes
 	   */
@@ -47178,7 +47728,7 @@ function requireCacheRevalidationHandler () {
 	    // https://datatracker.ietf.org/doc/html/rfc5861#section-4
 	    this.#successful = statusCode === 304 ||
 	      (this.#allowErrorStatusCodes && statusCode >= 500 && statusCode <= 504);
-	    this.#callback(this.#successful, this.#context);
+	    this.#callback(this.#successful, this.#context, statusCode, headers);
 	    this.#callback = null;
 
 	    if (this.#successful) {
@@ -47245,8 +47795,9 @@ function requireCache$1 () {
 	const CacheHandler = requireCacheHandler();
 	const MemoryCacheStore = requireMemoryCacheStore();
 	const CacheRevalidationHandler = requireCacheRevalidationHandler();
-	const { assertCacheStore, assertCacheMethods, makeCacheKey, normalizeHeaders, parseCacheControlHeader } = requireCache$2();
+	const { assertCacheStore, assertCacheMethods, makeCacheKey, normalizeHeaders, parseCacheControlHeader, isInvalidOrWildcardVaryHeader } = requireCache$2();
 	const { AbortError } = requireErrors$1();
+	const { parseHttpDate } = requireDate();
 
 	/**
 	 * @param {(string | RegExp)[] | undefined} origins
@@ -47267,6 +47818,44 @@ function requireCache$1 () {
 
 	const nop = () => {};
 
+	function trimOWS (value) {
+	  return value.replace(/^[\t ]+|[\t ]+$/g, '')
+	}
+
+	function arrayIncludes (array, value) {
+	  for (let i = 0; i < array.length; i++) {
+	    if (array[i] === value) {
+	      return true
+	    }
+	  }
+
+	  return false
+	}
+
+	function hasPragmaNoCache (headers) {
+	  const pragma = headers?.pragma;
+	  if (!pragma) {
+	    return false
+	  }
+
+	  const values = Array.isArray(pragma) ? pragma : [pragma];
+	  for (let i = 0; i < values.length; i++) {
+	    const value = values[i];
+	    if (typeof value !== 'string') {
+	      continue
+	    }
+
+	    const directives = value.split(',');
+	    for (let j = 0; j < directives.length; j++) {
+	      if (trimOWS(directives[j]).toLowerCase() === 'no-cache') {
+	        return true
+	      }
+	    }
+	  }
+
+	  return false
+	}
+
 	/**
 	 * @typedef {(options: import('../../types/dispatcher.d.ts').default.DispatchOptions, handler: import('../../types/dispatcher.d.ts').default.DispatchHandler) => void} DispatchFn
 	 */
@@ -47296,16 +47885,92 @@ function requireCache$1 () {
 	  return false
 	}
 
+	/**
+	 * @param {import('../../types/cache-interceptor.d.ts').default.GetResult} result
+	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheOptions['type']} cacheType
+	 * @returns {boolean}
+	 */
+	function staleResponseRequiresRevalidation (result, cacheType) {
+	  return result.cacheControlDirectives?.['must-revalidate'] === true ||
+	    (cacheType === 'shared' && (
+	      result.cacheControlDirectives?.['proxy-revalidate'] === true ||
+	      // https://www.rfc-editor.org/rfc/rfc9111.html#section-5.2.2.10
+	      // s-maxage implies proxy-revalidate for shared caches.
+	      result.cacheControlDirectives?.['s-maxage'] !== undefined
+	    ))
+	}
+
+	/**
+	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheOptions['type']} cacheType
+	 * @param {import('../../types/header.d.ts').IncomingHttpHeaders} headers
+	 * @returns {boolean}
+	 */
+	function revalidationResponseDisallowsCachedReuse (cacheType, headers) {
+	  if (headers.vary && isInvalidOrWildcardVaryHeader(headers.vary)) {
+	    return true
+	  }
+
+	  const cacheControl = headers['cache-control'];
+	  if (!cacheControl) {
+	    return false
+	  }
+
+	  const cacheControlDirectives = parseCacheControlHeader(cacheControl);
+	  return cacheControlDirectives['no-store'] === true ||
+	    (cacheType === 'shared' && cacheControlDirectives.private === true)
+	}
+
+	function revalidationResponseUpdatesCacheControl (headers) {
+	  return headers['cache-control'] !== undefined
+	}
+
+	function deleteCachedValue (store, cacheKey) {
+	  try {
+	    store.delete(cacheKey)?.catch?.(nop);
+	  } catch {
+	    // Fail silently
+	  }
+	}
+
+	function getUsableLastModified (headers) {
+	  const lastModified = headers?.['last-modified'];
+	  if (typeof lastModified === 'string' && parseHttpDate(lastModified)) {
+	    return lastModified
+	  }
+	}
+
+	function makeRevalidationHeaders (opts, result) {
+	  const headers = {
+	    ...opts.headers,
+	    'if-modified-since': getUsableLastModified(result.headers) ?? new Date(result.cachedAt).toUTCString()
+	  };
+
+	  if (result.etag) {
+	    headers['if-none-match'] = result.etag;
+	  }
+
+	  if (result.vary) {
+	    for (const key in result.vary) {
+	      if (result.vary[key] != null) {
+	        headers[key] = result.vary[key];
+	      }
+	    }
+	  }
+
+	  return headers
+	}
+
 	/**
 	 * @param {import('../../types/cache-interceptor.d.ts').default.GetResult} result
 	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheControlDirectives | undefined} cacheControlDirectives
+	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheOptions['type']} cacheType
 	 * @returns {boolean}
 	 */
-	function isStale (result, cacheControlDirectives) {
+	function isStale (result, cacheControlDirectives, cacheType) {
 	  const now = Date.now();
 	  if (now > result.staleAt) {
 	    // Response is stale
-	    if (cacheControlDirectives?.['max-stale']) {
+	    if (!staleResponseRequiresRevalidation(result, cacheType) && cacheControlDirectives?.['max-stale']) {
 	      // There's a threshold where we can serve stale responses, let's see if
 	      //  we're in it
 	      // https://www.rfc-editor.org/rfc/rfc9111.html#name-max-stale
@@ -47332,11 +47997,12 @@ function requireCache$1 () {
 	/**
 	 * Check if we're within the stale-while-revalidate window for a stale response
 	 * @param {import('../../types/cache-interceptor.d.ts').default.GetResult} result
+	 * @param {import('../../types/cache-interceptor.d.ts').default.CacheOptions['type']} cacheType
 	 * @returns {boolean}
 	 */
-	function withinStaleWhileRevalidateWindow (result) {
+	function withinStaleWhileRevalidateWindow (result, cacheType) {
 	  const staleWhileRevalidate = result.cacheControlDirectives?.['stale-while-revalidate'];
-	  if (!staleWhileRevalidate) {
+	  if (!staleWhileRevalidate || staleResponseRequiresRevalidation(result, cacheType)) {
 	    return false
 	  }
 
@@ -47506,14 +48172,10 @@ function requireCache$1 () {
 	  }
 
 	  const age = Math.round((now - result.cachedAt) / 1000);
-	  if (reqCacheControl?.['max-age'] && age >= reqCacheControl['max-age']) {
-	    // Response is considered expired for this specific request
-	    //  https://www.rfc-editor.org/rfc/rfc9111.html#section-5.2.1.1
-	    return dispatch(opts, handler)
-	  }
+	  const requestMaxAgeExpired = reqCacheControl?.['max-age'] !== undefined && age >= reqCacheControl['max-age'];
 
-	  const stale = isStale(result, reqCacheControl);
-	  const revalidate = needsRevalidation(result, reqCacheControl, opts);
+	  const stale = requestMaxAgeExpired || isStale(result, reqCacheControl, globalOpts.type);
+	  const revalidate = requestMaxAgeExpired || needsRevalidation(result, reqCacheControl, opts);
 
 	  // Check if the response is stale
 	  if (stale || revalidate) {
@@ -47525,28 +48187,13 @@ function requireCache$1 () {
 
 	    // RFC 5861: If we're within stale-while-revalidate window, serve stale immediately
 	    // and revalidate in background, unless immediate revalidation is necessary
-	    if (!revalidate && withinStaleWhileRevalidateWindow(result)) {
+	    if (!revalidate && withinStaleWhileRevalidateWindow(result, globalOpts.type)) {
 	      // Serve stale response immediately
 	      sendCachedValue(handler, opts, result, age, null, true);
 
 	      // Start background revalidation (fire-and-forget)
 	      queueMicrotask(() => {
-	        const headers = {
-	          ...opts.headers,
-	          'if-modified-since': new Date(result.cachedAt).toUTCString()
-	        };
-
-	        if (result.etag) {
-	          headers['if-none-match'] = result.etag;
-	        }
-
-	        if (result.vary) {
-	          for (const key in result.vary) {
-	            if (result.vary[key] != null) {
-	              headers[key] = result.vary[key];
-	            }
-	          }
-	        }
+	        const headers = makeRevalidationHeaders(opts, result);
 
 	        // Background revalidation - update cache if we get new data
 	        dispatch(
@@ -47570,28 +48217,15 @@ function requireCache$1 () {
 	    }
 
 	    let withinStaleIfErrorThreshold = false;
-	    const staleIfErrorExpiry = result.cacheControlDirectives['stale-if-error'] ?? reqCacheControl?.['stale-if-error'];
-	    if (staleIfErrorExpiry) {
-	      withinStaleIfErrorThreshold = now < (result.staleAt + (staleIfErrorExpiry * 1000));
-	    }
-
-	    const headers = {
-	      ...opts.headers,
-	      'if-modified-since': new Date(result.cachedAt).toUTCString()
-	    };
-
-	    if (result.etag) {
-	      headers['if-none-match'] = result.etag;
-	    }
-
-	    if (result.vary) {
-	      for (const key in result.vary) {
-	        if (result.vary[key] != null) {
-	          headers[key] = result.vary[key];
-	        }
+	    if (!staleResponseRequiresRevalidation(result, globalOpts.type)) {
+	      const staleIfErrorExpiry = result.cacheControlDirectives['stale-if-error'] ?? reqCacheControl?.['stale-if-error'];
+	      if (staleIfErrorExpiry) {
+	        withinStaleIfErrorThreshold = now < (result.staleAt + (staleIfErrorExpiry * 1000));
 	      }
 	    }
 
+	    const headers = makeRevalidationHeaders(opts, result);
+
 	    // We need to revalidate the response
 	    return dispatch(
 	      {
@@ -47599,8 +48233,23 @@ function requireCache$1 () {
 	        headers
 	      },
 	      new CacheRevalidationHandler(
-	        (success, context) => {
+	        (success, context, statusCode, headers) => {
 	          if (success) {
+	            if (statusCode === 304) {
+	              if (revalidationResponseDisallowsCachedReuse(globalOpts.type, headers)) {
+	                if (util.isStream(result.body)) {
+	                  result.body.on('error', nop).destroy();
+	                }
+
+	                deleteCachedValue(globalOpts.store, cacheKey);
+	                return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler))
+	              }
+
+	              if (revalidationResponseUpdatesCacheControl(headers)) {
+	                deleteCachedValue(globalOpts.store, cacheKey);
+	              }
+	            }
+
 	            // TODO: successful revalidation should be considered fresh (not give stale warning).
 	            sendCachedValue(handler, opts, result, age, context, stale);
 	          } else if (util.isStream(result.body)) {
@@ -47657,11 +48306,17 @@ function requireCache$1 () {
 	    type
 	  };
 
-	  const safeMethodsToNotCache = util.safeHTTPMethods.filter(method => methods.includes(method) === false);
+	  const safeMethodsToNotCache = [];
+	  for (let i = 0; i < util.safeHTTPMethods.length; i++) {
+	    const method = util.safeHTTPMethods[i];
+	    if (!arrayIncludes(methods, method)) {
+	      safeMethodsToNotCache.push(method);
+	    }
+	  }
 
 	  return dispatch => {
 	    return (opts, handler) => {
-	      if (!opts.origin || safeMethodsToNotCache.includes(opts.method)) {
+	      if (!opts.origin || arrayIncludes(safeMethodsToNotCache, opts.method)) {
 	        // Not a method we want to cache or we don't have the origin, skip
 	        return dispatch(opts, handler)
 	      }
@@ -47696,7 +48351,9 @@ function requireCache$1 () {
 
 	      const reqCacheControl = opts.headers?.['cache-control']
 	        ? parseCacheControlHeader(opts.headers['cache-control'])
-	        : undefined;
+	        : hasPragmaNoCache(opts.headers)
+	          ? { 'no-cache': true }
+	          : undefined;
 
 	      if (reqCacheControl?.['no-store']) {
 	        return dispatch(opts, handler)
@@ -49056,7 +49713,13 @@ function requireSqliteCacheStore () {
 	      return false
 	    }
 
-	    return lhs.every((x, i) => x === rhs[i])
+	    for (let i = 0; i < lhs.length; i++) {
+	      if (lhs[i] !== rhs[i]) {
+	        return false
+	      }
+	    }
+
+	    return true
 	  }
 
 	  return lhs === rhs
@@ -55456,7 +56119,7 @@ function requireUtil$4 () {
 
 	    if (
 	      code < 0x20 || // exclude CTLs (0-31)
-	      code === 0x7F || // DEL
+	      code > 0x7E || // exclude DEL and non-ascii
 	      code === 0x3B // ;
 	    ) {
 	      throw new Error('Invalid cookie path')
@@ -55465,16 +56128,80 @@ function requireUtil$4 () {
 	}
 
 	/**
-	 * I have no idea why these values aren't allowed to be honest,
-	 * but Deno tests these. - Khafra
+	 * <let-dig> ::= <letter> | <digit>
+	 *
+	 * <letter> ::= any one of the 52 alphabetic characters A through Z in
+	 * upper case and a through z in lower case
+	 *
+	 * <digit> ::= any one of the ten digits 0 through 9r
+	 *
+	 * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+	 * @param {number} code
+	 */
+	function isLetterOrDigit (code) {
+	  return (
+	    (code >= 0x30 && code <= 0x39) || // 0-9
+	    (code >= 0x41 && code <= 0x5A) || // A-Z
+	    (code >= 0x61 && code <= 0x7A) // a-z
+	  )
+	}
+
+	/**
+	 * Validates a cookie domain against the "preferred name syntax".
+	 *
+	 * <domain>      ::= <subdomain> | " "
+	 * <subdomain>   ::= <label> | <subdomain> "." <label>
+	 * <label>       ::= <let-dig> [ [ <ldh-str> ] <let-dig> ]
+	 * <ldh-str>     ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+	 * <let-dig-hyp> ::= <let-dig> | "-"
+	 *
+	 * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+	 * @see https://www.rfc-editor.org/rfc/rfc1123#section-2.1
+	 * @see https://www.rfc-editor.org/rfc/rfc1035#section-2.3.4
 	 * @param {string} domain
 	 */
 	function validateCookieDomain (domain) {
-	  if (
-	    domain.startsWith('-') ||
-	    domain.endsWith('.') ||
-	    domain.endsWith('-')
-	  ) {
+	  // <domain> ::= <subdomain> | " "
+	  if (domain === ' ') {
+	    return
+	  }
+
+	  if (domain.length > 255) {
+	    throw new Error('Invalid cookie domain')
+	  }
+
+	  let labelLength = 0;
+
+	  for (let i = 0; i < domain.length; ++i) {
+	    const code = domain.charCodeAt(i);
+
+	    if (code === 0x2E) {
+	      if (labelLength === 0) {
+	        throw new Error('Invalid cookie domain')
+	      }
+
+	      if (domain.charCodeAt(i - 1) === 0x2D) { // "-"
+	        throw new Error('Invalid cookie domain')
+	      }
+
+	      labelLength = 0;
+	      continue
+	    }
+
+	    if (labelLength === 0 && !isLetterOrDigit(code)) {
+	      throw new Error('Invalid cookie domain')
+	    }
+
+	    if (!isLetterOrDigit(code) && code !== 0x2D) { // "-"
+	      throw new Error('Invalid cookie domain')
+	    }
+
+	    if (++labelLength > 63) {
+	      throw new Error('Invalid cookie domain')
+	    }
+	  }
+
+	  if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 0x2D) { // "-"
 	    throw new Error('Invalid cookie domain')
 	  }
 	}
@@ -55617,7 +56344,13 @@ function requireUtil$4 () {
 
 	    const [key, ...value] = part.split('=');
 
-	    out.push(`${key.trim()}=${value.join('=')}`);
+	    const trimmedKey = key.trim();
+	    const joinedValue = value.join('=');
+
+	    validateCookieName(trimmedKey);
+	    validateCookieValue(joinedValue);
+
+	    out.push(`${trimmedKey}=${joinedValue}`);
 	  }
 
 	  return out.join('; ')
@@ -87707,15 +88440,19 @@ function requireJson () {
 	function json (options) {
 	  var opts = options || {};
 
-	  var limit = typeof opts.limit !== 'number'
-	    ? bytes.parse(opts.limit || '100kb')
-	    : opts.limit;
+	  var limit = typeof opts.limit === 'undefined' || opts.limit === null
+	    ? 102400 // 100kb default
+	    : bytes.parse(opts.limit);
 	  var inflate = opts.inflate !== false;
 	  var reviver = opts.reviver;
 	  var strict = opts.strict !== false;
 	  var type = opts.type || 'application/json';
 	  var verify = opts.verify || false;
 
+	  if (limit === null) {
+	    throw new TypeError('option limit "' + String(opts.limit) + '" is invalid')
+	  }
+
 	  if (verify !== false && typeof verify !== 'function') {
 	    throw new TypeError('option verify must be function')
 	  }
@@ -87938,12 +88675,16 @@ function requireRaw () {
 	  var opts = options || {};
 
 	  var inflate = opts.inflate !== false;
-	  var limit = typeof opts.limit !== 'number'
-	    ? bytes.parse(opts.limit || '100kb')
-	    : opts.limit;
+	  var limit = typeof opts.limit === 'undefined' || opts.limit === null
+	    ? 102400 // 100kb default
+	    : bytes.parse(opts.limit);
 	  var type = opts.type || 'application/octet-stream';
 	  var verify = opts.verify || false;
 
+	  if (limit === null) {
+	    throw new TypeError('option limit "' + String(opts.limit) + '" is invalid')
+	  }
+
 	  if (verify !== false && typeof verify !== 'function') {
 	    throw new TypeError('option verify must be function')
 	  }
@@ -88049,12 +88790,16 @@ function requireText () {
 
 	  var defaultCharset = opts.defaultCharset || 'utf-8';
 	  var inflate = opts.inflate !== false;
-	  var limit = typeof opts.limit !== 'number'
-	    ? bytes.parse(opts.limit || '100kb')
-	    : opts.limit;
+	  var limit = typeof opts.limit === 'undefined' || opts.limit === null
+	    ? 102400 // 100kb default
+	    : bytes.parse(opts.limit);
 	  var type = opts.type || 'text/plain';
 	  var verify = opts.verify || false;
 
+	  if (limit === null) {
+	    throw new TypeError('option limit "' + String(opts.limit) + '" is invalid')
+	  }
+
 	  if (verify !== false && typeof verify !== 'function') {
 	    throw new TypeError('option verify must be function')
 	  }
@@ -91321,12 +92066,16 @@ function requireUrlencoded () {
 
 	  var extended = opts.extended !== false;
 	  var inflate = opts.inflate !== false;
-	  var limit = typeof opts.limit !== 'number'
-	    ? bytes.parse(opts.limit || '100kb')
-	    : opts.limit;
+	  var limit = typeof opts.limit === 'undefined' || opts.limit === null
+	    ? 102400 // 100kb default
+	    : bytes.parse(opts.limit);
 	  var type = opts.type || 'application/x-www-form-urlencoded';
 	  var verify = opts.verify || false;
 
+	  if (limit === null) {
+	    throw new TypeError('option limit "' + String(opts.limit) + '" is invalid')
+	  }
+
 	  if (verify !== false && typeof verify !== 'function') {
 	    throw new TypeError('option verify must be function')
 	  }
@@ -112042,6 +112791,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 const EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+const EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -112090,7 +112850,7 @@ function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = EXPANSION_MAX } = options;
+    const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -112100,7 +112860,7 @@ function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -112114,22 +112874,117 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    const m = balanced('{', '}', str);
-    if (!m)
-        return [str];
-    // no need to expand pre, since it is guaranteed to be free of brace-sets
-    const pre = m.pre;
-    const post = m.post.length ? expand_(m.post, max, false) : [''];
-    if (/\$$/.test(m.pre)) {
-        for (let k = 0; k < post.length && k < max; k++) {
-            const expansion = pre + '{' + m.body + '}' + post[k];
-            expansions.push(expansion);
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
         }
     }
-    else {
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
+    for (;;) {
+        const m = balanced('{', '}', str);
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
+        // no need to expand pre, since it is guaranteed to be free of brace-sets
+        const pre = m.pre;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
+        }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
         const isSequence = isNumericSequence || isAlphaSequence;
@@ -112138,87 +112993,69 @@ function expand_(str, max, isTop) {
             // {a},b}
             if (m.post.match(/,(?!,).*\}/)) {
                 str = m.pre + '{' + m.body + escClose + m.post;
-                return expand_(str, max, true);
+                isTop = true;
+                continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
         }
-        let n;
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
+        }
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
-                }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
+                }
+            }
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
                     }
-                }
-                N.push(c);
-            }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
-    return expansions;
+    return acc;
 }
 
 const MAX_PATTERN_LENGTH = 1024 * 64;
@@ -190418,7 +191255,12 @@ function requireFastUri () {
 	 */
 	function resolve (baseURI, relativeURI, options) {
 	  const schemelessOptions = options ? Object.assign({ scheme: 'null' }, options) : { scheme: 'null' };
-	  const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true);
+	  const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+	  const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+	  if (baseMalformed || relativeMalformed) {
+	    throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')
+	  }
+	  const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
 	  schemelessOptions.skipEscape = true;
 	  return serialize(resolved, schemelessOptions)
 	}
@@ -190594,6 +191436,19 @@ function requireFastUri () {
 
 	const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
 
+	// Captures the authority component (between "//" and the next "/", "?" or "#"),
+	// with or without a scheme prefix, for the literal-backslash rejection below.
+	const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+
+	// Captures the leading authority-introducer region after an optional scheme: a
+	// run of forward slashes, backslashes, and the characters the WHATWG URL parser
+	// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer
+	// is exactly "//". Node treats "\" as "/" on special schemes and strips those
+	// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading
+	// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into
+	// the path group (host confusion / SSRF / redirect bypass).
+	const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
+
 	/**
 	 * @param {import('./types/index').URIComponent} parsed
 	 * @param {RegExpMatchArray} matches
@@ -190640,6 +191495,41 @@ function requireFastUri () {
 	    }
 	  }
 
+	  // A literal backslash (U+005C) is not a valid RFC 3986 URI character and is
+	  // not an authority delimiter. Reject it in the authority rather than
+	  // rewriting it: normalizing "\" -> "/" (WHATWG error recovery) could silently
+	  // change the resource identified by an otherwise-invalid input, and lets "\"
+	  // act as a host delimiter here while Node's native URL parses a different
+	  // host (SSRF / redirect / origin-allowlist bypass). Percent-encoded %5C is
+	  // untouched and remains valid encoded data.
+	  const authorityMatch = uri.match(AUTHORITY_PREFIX);
+	  if (authorityMatch !== null && authorityMatch[1].indexOf('\\') !== -1) {
+	    parsed.error = 'URI authority must not contain a literal backslash.';
+	    malformedAuthorityOrPort = true;
+	  }
+
+	  // Reject a malformed or whitespace-smuggled authority introducer. fast-uri
+	  // only recognizes a literal "//"; anything else in the leading separator run
+	  // (a backslash, or a "//" that appears only after removing the TAB/LF/CR that
+	  // Node strips) means the authority fast-uri parses differs from the one Node's
+	  // URL resolves. Reject rather than rewrite, mirroring the literal-backslash
+	  // guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.
+	  const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+	  if (introducerMatch !== null) {
+	    const region = introducerMatch[1];
+	    const normalizedRegion = region.replace(/[\t\n\r]/g, '');
+	    // Two or more leading separators introduce an authority.
+	    if (normalizedRegion.length >= 2) {
+	      if (normalizedRegion.slice(0, 2) !== '//') {
+	        parsed.error = parsed.error || 'URI authority must not contain a literal backslash.';
+	        malformedAuthorityOrPort = true;
+	      } else if (region.length !== normalizedRegion.length) {
+	        parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.';
+	        malformedAuthorityOrPort = true;
+	      }
+	    }
+	  }
+
 	  const matches = uri.match(URI_PARSE);
 
 	  if (matches) {
@@ -190697,7 +191587,7 @@ function requireFastUri () {
 	      if (parsed.host && (options.domainHost || (schemeHandler && schemeHandler.domainHost)) && isIP === false && nonSimpleDomain(parsed.host)) {
 	        // convert Unicode IDN -> ASCII IDN
 	        try {
-	          parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+	          parsed.host = new URL('http://' + parsed.host).hostname;
 	        } catch (e) {
 	          parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
 	        }