jose 4.14.3 → 4.14.5

package/README.md

@@ -129,4 +129,4 @@ Please note that certain algorithms may not be available depending on the runtim
 | Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
 | ------- | --------- | -------- | -------- |
 | [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
-| [v3.x](https://github.com/panva/jose/tree/v3.x), [v2.x](https://github.com/panva/jose/tree/v2.x), [v1.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
+| [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ❌ | ❌ |

package/dist/browser/jwe/flattened/decrypt.js

@@ -86,7 +86,12 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
-        encryptedKey = base64url(jwe.encrypted_key);
+        try {
+            encryptedKey = base64url(jwe.encrypted_key);
+        }
+        catch (_c) {
+            throw new JWEInvalid('Failed to base64url decode the encrypted_key');
+        }
     }
     let resolvedKey = false;
     if (typeof key === 'function') {
@@ -103,8 +108,20 @@ export async function flattenedDecrypt(jwe, key, options) {
         }
         cek = generateCek(enc);
     }
-    const iv = base64url(jwe.iv);
-    const tag = base64url(jwe.tag);
+    let iv;
+    let tag;
+    try {
+        iv = base64url(jwe.iv);
+    }
+    catch (_d) {
+        throw new JWEInvalid('Failed to base64url decode the iv');
+    }
+    try {
+        tag = base64url(jwe.tag);
+    }
+    catch (_e) {
+        throw new JWEInvalid('Failed to base64url decode the tag');
+    }
     const protectedHeader = encoder.encode((_a = jwe.protected) !== null && _a !== void 0 ? _a : '');
     let additionalData;
     if (jwe.aad !== undefined) {
@@ -113,7 +130,14 @@ export async function flattenedDecrypt(jwe, key, options) {
     else {
         additionalData = protectedHeader;
     }
-    let plaintext = await decrypt(enc, cek, base64url(jwe.ciphertext), iv, tag, additionalData);
+    let ciphertext;
+    try {
+        ciphertext = base64url(jwe.ciphertext);
+    }
+    catch (_f) {
+        throw new JWEInvalid('Failed to base64url decode the ciphertext');
+    }
+    let plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
     if (joseHeader.zip === 'DEF') {
         plaintext = await ((options === null || options === void 0 ? void 0 : options.inflateRaw) || inflate)(plaintext);
     }
@@ -122,7 +146,12 @@ export async function flattenedDecrypt(jwe, key, options) {
         result.protectedHeader = parsedProt;
     }
     if (jwe.aad !== undefined) {
-        result.additionalAuthenticatedData = base64url(jwe.aad);
+        try {
+            result.additionalAuthenticatedData = base64url(jwe.aad);
+        }
+        catch (_g) {
+            throw new JWEInvalid('Failed to base64url decode the aad');
+        }
     }
     if (jwe.unprotected !== undefined) {
         result.sharedUnprotectedHeader = jwe.unprotected;

package/dist/browser/jwks/remote.js

@@ -1,7 +1,11 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
-import { isCloudflareWorkers } from '../runtime/env.js';
 import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
 import { isJWKSLike, LocalJWKSet } from './local.js';
+function isCloudflareWorkers() {
+    return (typeof WebSocketPair !== 'undefined' ||
+        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
+        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
+}
 class RemoteJWKSet extends LocalJWKSet {
     constructor(url, options) {
         super({ keys: [] });

package/dist/browser/jws/flattened/verify.js

@@ -75,14 +75,25 @@ export async function flattenedVerify(jws, key, options) {
     }
     checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
-    const signature = base64url(jws.signature);
+    let signature;
+    try {
+        signature = base64url(jws.signature);
+    }
+    catch (_c) {
+        throw new JWSInvalid('Failed to base64url decode the signature');
+    }
     const verified = await verify(alg, key, signature, data);
     if (!verified) {
         throw new JWSSignatureVerificationFailed();
     }
     let payload;
     if (b64) {
-        payload = base64url(jws.payload);
+        try {
+            payload = base64url(jws.payload);
+        }
+        catch (_d) {
+            throw new JWSInvalid('Failed to base64url decode the payload');
+        }
     }
     else if (typeof jws.payload === 'string') {
         payload = encoder.encode(jws.payload);

package/dist/browser/lib/crypto_key.js

@@ -1,4 +1,3 @@
-import { isCloudflareWorkers } from '../runtime/env.js';
 function unusable(name, prop = 'algorithm.name') {
     return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -73,11 +72,6 @@ export function checkSigCryptoKey(key, alg, ...usages) {
         }
         case 'EdDSA': {
             if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
-                if (isCloudflareWorkers()) {
-                    if (isAlgorithm(key.algorithm, 'NODE-ED25519'))
-                        break;
-                    throw unusable('Ed25519, Ed448, or NODE-ED25519');
-                }
                 throw unusable('Ed25519 or Ed448');
             }
             break;

package/dist/browser/lib/decrypt_key_management.js

@@ -33,12 +33,22 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
             if (joseHeader.apu !== undefined) {
                 if (typeof joseHeader.apu !== 'string')
                     throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
-                partyUInfo = base64url(joseHeader.apu);
+                try {
+                    partyUInfo = base64url(joseHeader.apu);
+                }
+                catch (_a) {
+                    throw new JWEInvalid('Failed to base64url decode the apu');
+                }
             }
             if (joseHeader.apv !== undefined) {
                 if (typeof joseHeader.apv !== 'string')
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
-                partyVInfo = base64url(joseHeader.apv);
+                try {
+                    partyVInfo = base64url(joseHeader.apv);
+                }
+                catch (_b) {
+                    throw new JWEInvalid('Failed to base64url decode the apv');
+                }
             }
             const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
@@ -68,7 +78,14 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
-            return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, base64url(joseHeader.p2s));
+            let p2s;
+            try {
+                p2s = base64url(joseHeader.p2s);
+            }
+            catch (_c) {
+                throw new JWEInvalid('Failed to base64url decode the p2s');
+            }
+            return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, p2s);
         }
         case 'A128KW':
         case 'A192KW':
@@ -86,8 +103,20 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
             if (typeof joseHeader.tag !== 'string')
                 throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
-            const iv = base64url(joseHeader.iv);
-            const tag = base64url(joseHeader.tag);
+            let iv;
+            try {
+                iv = base64url(joseHeader.iv);
+            }
+            catch (_d) {
+                throw new JWEInvalid('Failed to base64url decode the iv');
+            }
+            let tag;
+            try {
+                tag = base64url(joseHeader.tag);
+            }
+            catch (_e) {
+                throw new JWEInvalid('Failed to base64url decode the tag');
+            }
             return aesGcmKw(alg, key, encryptedKey, iv, tag);
         }
         default: {

package/dist/browser/runtime/asn1.js

@@ -1,4 +1,3 @@
-import { isCloudflareWorkers } from './env.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { encodeBase64, decodeBase64 } from './base64url.js';
@@ -57,7 +56,7 @@ const getNamedCurve = (keyData) => {
     }
 };
 const genericImport = async (replace, keyFormat, pem, alg, options) => {
-    var _a, _b;
+    var _a;
     let algorithm;
     let keyUsages;
     const keyData = new Uint8Array(atob(pem.replace(replace, ''))
@@ -115,18 +114,7 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
         default:
             throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
     }
-    try {
-        return await crypto.subtle.importKey(keyFormat, keyData, algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
-    }
-    catch (err) {
-        if (algorithm.name === 'Ed25519' &&
-            (err === null || err === void 0 ? void 0 : err.name) === 'NotSupportedError' &&
-            isCloudflareWorkers()) {
-            algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
-            return await crypto.subtle.importKey(keyFormat, keyData, algorithm, (_b = options === null || options === void 0 ? void 0 : options.extractable) !== null && _b !== void 0 ? _b : false, keyUsages);
-        }
-        throw err;
-    }
+    return crypto.subtle.importKey(keyFormat, keyData, algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
 };
 export const fromPKCS8 = (pem, alg, options) => {
     return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, 'pkcs8', pem, alg, options);
@@ -208,7 +196,7 @@ export const fromX509 = (pem, alg, options) => {
         spki = getSPKI(pem);
     }
     catch (cause) {
-        throw new TypeError('failed to parse the X.509 certificate', { cause });
+        throw new TypeError('Failed to parse the X.509 certificate', { cause });
     }
     return fromSPKI(spki, alg, options);
 };

package/dist/browser/runtime/generate.js

@@ -1,4 +1,3 @@
-import { isCloudflareWorkers } from './env.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import random from './random.js';
@@ -51,7 +50,7 @@ function getModulusLengthOption(options) {
     return modulusLength;
 }
 export async function generateKeyPair(alg, options) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c;
     let algorithm;
     let keyUsages;
     switch (alg) {
@@ -138,16 +137,5 @@ export async function generateKeyPair(alg, options) {
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
-    try {
-        return (await crypto.subtle.generateKey(algorithm, (_c = options === null || options === void 0 ? void 0 : options.extractable) !== null && _c !== void 0 ? _c : false, keyUsages));
-    }
-    catch (err) {
-        if (algorithm.name === 'Ed25519' &&
-            (err === null || err === void 0 ? void 0 : err.name) === 'NotSupportedError' &&
-            isCloudflareWorkers()) {
-            algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
-            return (await crypto.subtle.generateKey(algorithm, (_d = options === null || options === void 0 ? void 0 : options.extractable) !== null && _d !== void 0 ? _d : false, keyUsages));
-        }
-        throw err;
-    }
+    return (crypto.subtle.generateKey(algorithm, (_c = options === null || options === void 0 ? void 0 : options.extractable) !== null && _c !== void 0 ? _c : false, keyUsages));
 }

package/dist/browser/runtime/jwk_to_key.js

@@ -1,4 +1,3 @@
-import { isCloudflareWorkers } from './env.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { decode as base64url } from './base64url.js';
@@ -139,17 +138,6 @@ const parse = async (jwk) => {
     const keyData = { ...jwk };
     delete keyData.alg;
     delete keyData.use;
-    try {
-        return await crypto.subtle.importKey('jwk', keyData, ...rest);
-    }
-    catch (err) {
-        if (algorithm.name === 'Ed25519' &&
-            (err === null || err === void 0 ? void 0 : err.name) === 'NotSupportedError' &&
-            isCloudflareWorkers()) {
-            rest[0] = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
-            return await crypto.subtle.importKey('jwk', keyData, ...rest);
-        }
-        throw err;
-    }
+    return crypto.subtle.importKey('jwk', keyData, ...rest);
 };
 export default parse;

package/dist/browser/runtime/subtle_dsa.js

@@ -1,4 +1,3 @@
-import { isCloudflareWorkers } from './env.js';
 import { JOSENotSupported } from '../util/errors.js';
 export default function subtleDsa(alg, algorithm) {
     const hash = `SHA-${alg.slice(-3)}`;
@@ -20,9 +19,6 @@ export default function subtleDsa(alg, algorithm) {
         case 'ES512':
             return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };
         case 'EdDSA':
-            if (isCloudflareWorkers() && algorithm.name === 'NODE-ED25519') {
-                return { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
-            }
             return { name: algorithm.name };
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);

package/dist/browser/util/decode_jwt.js

@@ -17,7 +17,7 @@ export function decodeJwt(jwt) {
         decoded = base64url(payload);
     }
     catch (_a) {
-        throw new JWTInvalid('Failed to parse the base64url encoded payload');
+        throw new JWTInvalid('Failed to base64url decode the payload');
     }
     let result;
     try {

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -89,7 +89,12 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
-        encryptedKey = (0, base64url_js_1.decode)(jwe.encrypted_key);
+        try {
+            encryptedKey = (0, base64url_js_1.decode)(jwe.encrypted_key);
+        }
+        catch {
+            throw new errors_js_1.JWEInvalid('Failed to base64url decode the encrypted_key');
+        }
     }
     let resolvedKey = false;
     if (typeof key === 'function') {
@@ -106,8 +111,20 @@ async function flattenedDecrypt(jwe, key, options) {
         }
         cek = (0, cek_js_1.default)(enc);
     }
-    const iv = (0, base64url_js_1.decode)(jwe.iv);
-    const tag = (0, base64url_js_1.decode)(jwe.tag);
+    let iv;
+    let tag;
+    try {
+        iv = (0, base64url_js_1.decode)(jwe.iv);
+    }
+    catch {
+        throw new errors_js_1.JWEInvalid('Failed to base64url decode the iv');
+    }
+    try {
+        tag = (0, base64url_js_1.decode)(jwe.tag);
+    }
+    catch {
+        throw new errors_js_1.JWEInvalid('Failed to base64url decode the tag');
+    }
     const protectedHeader = buffer_utils_js_1.encoder.encode((_a = jwe.protected) !== null && _a !== void 0 ? _a : '');
     let additionalData;
     if (jwe.aad !== undefined) {
@@ -116,7 +133,14 @@ async function flattenedDecrypt(jwe, key, options) {
     else {
         additionalData = protectedHeader;
     }
-    let plaintext = await (0, decrypt_js_1.default)(enc, cek, (0, base64url_js_1.decode)(jwe.ciphertext), iv, tag, additionalData);
+    let ciphertext;
+    try {
+        ciphertext = (0, base64url_js_1.decode)(jwe.ciphertext);
+    }
+    catch {
+        throw new errors_js_1.JWEInvalid('Failed to base64url decode the ciphertext');
+    }
+    let plaintext = await (0, decrypt_js_1.default)(enc, cek, ciphertext, iv, tag, additionalData);
     if (joseHeader.zip === 'DEF') {
         plaintext = await ((options === null || options === void 0 ? void 0 : options.inflateRaw) || zlib_js_1.inflate)(plaintext);
     }
@@ -125,7 +149,12 @@ async function flattenedDecrypt(jwe, key, options) {
         result.protectedHeader = parsedProt;
     }
     if (jwe.aad !== undefined) {
-        result.additionalAuthenticatedData = (0, base64url_js_1.decode)(jwe.aad);
+        try {
+            result.additionalAuthenticatedData = (0, base64url_js_1.decode)(jwe.aad);
+        }
+        catch {
+            throw new errors_js_1.JWEInvalid('Failed to base64url decode the aad');
+        }
     }
     if (jwe.unprotected !== undefined) {
         result.sharedUnprotectedHeader = jwe.unprotected;

package/dist/node/cjs/jwks/remote.js

@@ -2,9 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRemoteJWKSet = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
-const env_js_1 = require("../runtime/env.js");
 const errors_js_1 = require("../util/errors.js");
 const local_js_1 = require("./local.js");
+function isCloudflareWorkers() {
+    return (typeof WebSocketPair !== 'undefined' ||
+        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
+        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
+}
 class RemoteJWKSet extends local_js_1.LocalJWKSet {
     constructor(url, options) {
         super({ keys: [] });
@@ -48,7 +52,7 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
         }
     }
     async reload() {
-        if (this._pendingFetch && (0, env_js_1.isCloudflareWorkers)()) {
+        if (this._pendingFetch && isCloudflareWorkers()) {
             this._pendingFetch = undefined;
         }
         this._pendingFetch || (this._pendingFetch = (0, fetch_jwks_js_1.default)(this._url, this._timeoutDuration, this._options)

package/dist/node/cjs/jws/flattened/verify.js

@@ -78,14 +78,25 @@ async function flattenedVerify(jws, key, options) {
     }
     (0, check_key_type_js_1.default)(alg, key, 'verify');
     const data = (0, buffer_utils_js_1.concat)(buffer_utils_js_1.encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), buffer_utils_js_1.encoder.encode('.'), typeof jws.payload === 'string' ? buffer_utils_js_1.encoder.encode(jws.payload) : jws.payload);
-    const signature = (0, base64url_js_1.decode)(jws.signature);
+    let signature;
+    try {
+        signature = (0, base64url_js_1.decode)(jws.signature);
+    }
+    catch {
+        throw new errors_js_1.JWSInvalid('Failed to base64url decode the signature');
+    }
     const verified = await (0, verify_js_1.default)(alg, key, signature, data);
     if (!verified) {
         throw new errors_js_1.JWSSignatureVerificationFailed();
     }
     let payload;
     if (b64) {
-        payload = (0, base64url_js_1.decode)(jws.payload);
+        try {
+            payload = (0, base64url_js_1.decode)(jws.payload);
+        }
+        catch {
+            throw new errors_js_1.JWSInvalid('Failed to base64url decode the payload');
+        }
     }
     else if (typeof jws.payload === 'string') {
         payload = buffer_utils_js_1.encoder.encode(jws.payload);

package/dist/node/cjs/lib/crypto_key.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkEncCryptoKey = exports.checkSigCryptoKey = void 0;
-const env_js_1 = require("../runtime/env.js");
 function unusable(name, prop = 'algorithm.name') {
     return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -76,11 +75,6 @@ function checkSigCryptoKey(key, alg, ...usages) {
         }
         case 'EdDSA': {
             if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
-                if ((0, env_js_1.isCloudflareWorkers)()) {
-                    if (isAlgorithm(key.algorithm, 'NODE-ED25519'))
-                        break;
-                    throw unusable('Ed25519, Ed448, or NODE-ED25519');
-                }
                 throw unusable('Ed25519 or Ed448');
             }
             break;

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -35,12 +35,22 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
             if (joseHeader.apu !== undefined) {
                 if (typeof joseHeader.apu !== 'string')
                     throw new errors_js_1.JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
-                partyUInfo = (0, base64url_js_1.decode)(joseHeader.apu);
+                try {
+                    partyUInfo = (0, base64url_js_1.decode)(joseHeader.apu);
+                }
+                catch {
+                    throw new errors_js_1.JWEInvalid('Failed to base64url decode the apu');
+                }
             }
             if (joseHeader.apv !== undefined) {
                 if (typeof joseHeader.apv !== 'string')
                     throw new errors_js_1.JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
-                partyVInfo = (0, base64url_js_1.decode)(joseHeader.apv);
+                try {
+                    partyVInfo = (0, base64url_js_1.decode)(joseHeader.apv);
+                }
+                catch {
+                    throw new errors_js_1.JWEInvalid('Failed to base64url decode the apv');
+                }
             }
             const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? (0, cek_js_1.bitLength)(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
@@ -70,7 +80,14 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new errors_js_1.JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
-            return (0, pbes2kw_js_1.decrypt)(alg, key, encryptedKey, joseHeader.p2c, (0, base64url_js_1.decode)(joseHeader.p2s));
+            let p2s;
+            try {
+                p2s = (0, base64url_js_1.decode)(joseHeader.p2s);
+            }
+            catch {
+                throw new errors_js_1.JWEInvalid('Failed to base64url decode the p2s');
+            }
+            return (0, pbes2kw_js_1.decrypt)(alg, key, encryptedKey, joseHeader.p2c, p2s);
         }
         case 'A128KW':
         case 'A192KW':
@@ -88,8 +105,20 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new errors_js_1.JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
             if (typeof joseHeader.tag !== 'string')
                 throw new errors_js_1.JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
-            const iv = (0, base64url_js_1.decode)(joseHeader.iv);
-            const tag = (0, base64url_js_1.decode)(joseHeader.tag);
+            let iv;
+            try {
+                iv = (0, base64url_js_1.decode)(joseHeader.iv);
+            }
+            catch {
+                throw new errors_js_1.JWEInvalid('Failed to base64url decode the iv');
+            }
+            let tag;
+            try {
+                tag = (0, base64url_js_1.decode)(joseHeader.tag);
+            }
+            catch {
+                throw new errors_js_1.JWEInvalid('Failed to base64url decode the tag');
+            }
             return (0, aesgcmkw_js_1.unwrap)(alg, key, encryptedKey, iv, tag);
         }
         default: {

package/dist/node/cjs/runtime/base64url.js

@@ -4,7 +4,6 @@ exports.decode = exports.encode = exports.encodeBase64 = exports.decodeBase64 =
 const buffer_1 = require("buffer");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 let encode;
-exports.encode = encode;
 function normalize(input) {
     let encoded = input;
     if (encoded instanceof Uint8Array) {

package/dist/node/cjs/util/decode_jwt.js

@@ -20,7 +20,7 @@ function decodeJwt(jwt) {
         decoded = (0, base64url_js_1.decode)(payload);
     }
     catch {
-        throw new errors_js_1.JWTInvalid('Failed to parse the base64url encoded payload');
+        throw new errors_js_1.JWTInvalid('Failed to base64url decode the payload');
     }
     let result;
     try {

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -86,7 +86,12 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
-        encryptedKey = base64url(jwe.encrypted_key);
+        try {
+            encryptedKey = base64url(jwe.encrypted_key);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the encrypted_key');
+        }
     }
     let resolvedKey = false;
     if (typeof key === 'function') {
@@ -103,8 +108,20 @@ export async function flattenedDecrypt(jwe, key, options) {
         }
         cek = generateCek(enc);
     }
-    const iv = base64url(jwe.iv);
-    const tag = base64url(jwe.tag);
+    let iv;
+    let tag;
+    try {
+        iv = base64url(jwe.iv);
+    }
+    catch {
+        throw new JWEInvalid('Failed to base64url decode the iv');
+    }
+    try {
+        tag = base64url(jwe.tag);
+    }
+    catch {
+        throw new JWEInvalid('Failed to base64url decode the tag');
+    }
     const protectedHeader = encoder.encode((_a = jwe.protected) !== null && _a !== void 0 ? _a : '');
     let additionalData;
     if (jwe.aad !== undefined) {
@@ -113,7 +130,14 @@ export async function flattenedDecrypt(jwe, key, options) {
     else {
         additionalData = protectedHeader;
     }
-    let plaintext = await decrypt(enc, cek, base64url(jwe.ciphertext), iv, tag, additionalData);
+    let ciphertext;
+    try {
+        ciphertext = base64url(jwe.ciphertext);
+    }
+    catch {
+        throw new JWEInvalid('Failed to base64url decode the ciphertext');
+    }
+    let plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
     if (joseHeader.zip === 'DEF') {
         plaintext = await ((options === null || options === void 0 ? void 0 : options.inflateRaw) || inflate)(plaintext);
     }
@@ -122,7 +146,12 @@ export async function flattenedDecrypt(jwe, key, options) {
         result.protectedHeader = parsedProt;
     }
     if (jwe.aad !== undefined) {
-        result.additionalAuthenticatedData = base64url(jwe.aad);
+        try {
+            result.additionalAuthenticatedData = base64url(jwe.aad);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the aad');
+        }
     }
     if (jwe.unprotected !== undefined) {
         result.sharedUnprotectedHeader = jwe.unprotected;

package/dist/node/esm/jwks/remote.js

@@ -1,7 +1,11 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
-import { isCloudflareWorkers } from '../runtime/env.js';
 import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
 import { isJWKSLike, LocalJWKSet } from './local.js';
+function isCloudflareWorkers() {
+    return (typeof WebSocketPair !== 'undefined' ||
+        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
+        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
+}
 class RemoteJWKSet extends LocalJWKSet {
     constructor(url, options) {
         super({ keys: [] });

package/dist/node/esm/jws/flattened/verify.js

@@ -75,14 +75,25 @@ export async function flattenedVerify(jws, key, options) {
     }
     checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
-    const signature = base64url(jws.signature);
+    let signature;
+    try {
+        signature = base64url(jws.signature);
+    }
+    catch {
+        throw new JWSInvalid('Failed to base64url decode the signature');
+    }
     const verified = await verify(alg, key, signature, data);
     if (!verified) {
         throw new JWSSignatureVerificationFailed();
     }
     let payload;
     if (b64) {
-        payload = base64url(jws.payload);
+        try {
+            payload = base64url(jws.payload);
+        }
+        catch {
+            throw new JWSInvalid('Failed to base64url decode the payload');
+        }
     }
     else if (typeof jws.payload === 'string') {
         payload = encoder.encode(jws.payload);

package/dist/node/esm/lib/crypto_key.js

@@ -1,4 +1,3 @@
-import { isCloudflareWorkers } from '../runtime/env.js';
 function unusable(name, prop = 'algorithm.name') {
     return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -73,11 +72,6 @@ export function checkSigCryptoKey(key, alg, ...usages) {
         }
         case 'EdDSA': {
             if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
-                if (isCloudflareWorkers()) {
-                    if (isAlgorithm(key.algorithm, 'NODE-ED25519'))
-                        break;
-                    throw unusable('Ed25519, Ed448, or NODE-ED25519');
-                }
                 throw unusable('Ed25519 or Ed448');
             }
             break;

package/dist/node/esm/lib/decrypt_key_management.js

@@ -33,12 +33,22 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
             if (joseHeader.apu !== undefined) {
                 if (typeof joseHeader.apu !== 'string')
                     throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
-                partyUInfo = base64url(joseHeader.apu);
+                try {
+                    partyUInfo = base64url(joseHeader.apu);
+                }
+                catch {
+                    throw new JWEInvalid('Failed to base64url decode the apu');
+                }
             }
             if (joseHeader.apv !== undefined) {
                 if (typeof joseHeader.apv !== 'string')
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
-                partyVInfo = base64url(joseHeader.apv);
+                try {
+                    partyVInfo = base64url(joseHeader.apv);
+                }
+                catch {
+                    throw new JWEInvalid('Failed to base64url decode the apv');
+                }
             }
             const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
@@ -68,7 +78,14 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
-            return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, base64url(joseHeader.p2s));
+            let p2s;
+            try {
+                p2s = base64url(joseHeader.p2s);
+            }
+            catch {
+                throw new JWEInvalid('Failed to base64url decode the p2s');
+            }
+            return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, p2s);
         }
         case 'A128KW':
         case 'A192KW':
@@ -86,8 +103,20 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
             if (typeof joseHeader.tag !== 'string')
                 throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
-            const iv = base64url(joseHeader.iv);
-            const tag = base64url(joseHeader.tag);
+            let iv;
+            try {
+                iv = base64url(joseHeader.iv);
+            }
+            catch {
+                throw new JWEInvalid('Failed to base64url decode the iv');
+            }
+            let tag;
+            try {
+                tag = base64url(joseHeader.tag);
+            }
+            catch {
+                throw new JWEInvalid('Failed to base64url decode the tag');
+            }
             return aesGcmKw(alg, key, encryptedKey, iv, tag);
         }
         default: {

package/dist/node/esm/util/decode_jwt.js

@@ -17,7 +17,7 @@ export function decodeJwt(jwt) {
         decoded = base64url(payload);
     }
     catch {
-        throw new JWTInvalid('Failed to parse the base64url encoded payload');
+        throw new JWTInvalid('Failed to base64url decode the payload');
     }
     let result;
     try {

package/dist/types/jwe/compact/encrypt.d.ts

@@ -13,6 +13,7 @@ export declare class CompactEncrypt {
      *
      * @deprecated You should not use this method. It is only really intended for test and vector
      *   validation purposes.
+     *
      * @param cek JWE Content Encryption Key.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
@@ -22,6 +23,7 @@ export declare class CompactEncrypt {
      *
      * @deprecated You should not use this method. It is only really intended for test and vector
      *   validation purposes.
+     *
      * @param iv JWE Initialization Vector.
      */
     setInitializationVector(iv: Uint8Array): this;

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -55,6 +55,7 @@ export declare class FlattenedEncrypt {
      *
      * @deprecated You should not use this method. It is only really intended for test and vector
      *   validation purposes.
+     *
      * @param cek JWE Content Encryption Key.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
@@ -64,6 +65,7 @@ export declare class FlattenedEncrypt {
      *
      * @deprecated You should not use this method. It is only really intended for test and vector
      *   validation purposes.
+     *
      * @param iv JWE Initialization Vector.
      */
     setInitializationVector(iv: Uint8Array): this;

package/dist/types/jwk/thumbprint.d.ts

@@ -5,6 +5,7 @@ import type { JWK } from '../types';
  * @param jwk JSON Web Key.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".
+ *
  * @see {@link https://www.rfc-editor.org/rfc/rfc7638 RFC7638}
  */
 export declare function calculateJwkThumbprint(jwk: JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
@@ -14,6 +15,7 @@ export declare function calculateJwkThumbprint(jwk: JWK, digestAlgorithm?: 'sha2
  * @param jwk JSON Web Key.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".
+ *
  * @see {@link https://www.rfc-editor.org/rfc/rfc9278 RFC9278}
  */
 export declare function calculateJwkThumbprintUri(jwk: JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;

package/dist/types/jwt/encrypt.d.ts

@@ -34,6 +34,7 @@ export declare class EncryptJWT extends ProduceJWT {
      *
      * @deprecated You should not use this method. It is only really intended for test and vector
      *   validation purposes.
+     *
      * @param cek JWE Content Encryption Key.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
@@ -43,6 +44,7 @@ export declare class EncryptJWT extends ProduceJWT {
      *
      * @deprecated You should not use this method. It is only really intended for test and vector
      *   validation purposes.
+     *
      * @param iv JWE Initialization Vector.
      */
     setInitializationVector(iv: Uint8Array): this;

package/dist/types/types.d.ts

@@ -299,6 +299,7 @@ export interface JWEHeaderParameters extends JoseHeaderParameters {
    *
    * @deprecated Compression of data SHOULD NOT be done before encryption, because such compressed
    *   data often reveals information about the plaintext.
+   *
    * @see {@link https://www.rfc-editor.org/rfc/rfc8725#name-avoid-compression-of-encryp Avoid Compression of Encryption Inputs}
    */
   zip?: string
@@ -487,6 +488,7 @@ export interface JWTPayload {
  *
  * @deprecated Compression of data SHOULD NOT be done before encryption, because such compressed
  *   data often reveals information about the plaintext.
+ *
  * @see {@link https://www.rfc-editor.org/rfc/rfc8725#name-avoid-compression-of-encryp Avoid Compression of Encryption Inputs}
  */
 export interface DeflateFunction {
@@ -499,6 +501,7 @@ export interface DeflateFunction {
  *
  * @deprecated Compression of data SHOULD NOT be done before encryption, because such compressed
  *   data often reveals information about the plaintext.
+ *
  * @see {@link https://www.rfc-editor.org/rfc/rfc8725#name-avoid-compression-of-encryp Avoid Compression of Encryption Inputs}
  */
 export interface InflateFunction {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.14.3",
+  "version": "4.14.5",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",
@@ -20,7 +20,6 @@
     "encrypt",
     "flattened",
     "general",
-    "isomorphic",
     "jose",
     "json web token",
     "jsonwebtoken",
@@ -43,11 +42,11 @@
     "sign",
     "signature",
     "spki",
-    "universal",
     "validate",
     "vercel",
     "verify",
     "webcrypto",
+    "workerd",
     "workers",
     "x509"
   ],

package/dist/browser/runtime/env.js

@@ -1,5 +0,0 @@
-export function isCloudflareWorkers() {
-    return (typeof WebSocketPair !== 'undefined' ||
-        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
-        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
-}

package/dist/node/cjs/runtime/env.js

@@ -1,7 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isCloudflareWorkers = void 0;
-function isCloudflareWorkers() {
-    return false;
-}
-exports.isCloudflareWorkers = isCloudflareWorkers;

package/dist/node/esm/runtime/env.js

@@ -1,3 +0,0 @@
-export function isCloudflareWorkers() {
-    return false;
-}