kinetex 1.0.0 → 1.1.0

package/dist/cjs/client.js

@@ -130,6 +130,40 @@ function randomHex(len) {
 // ============================================================================
 // §3  HAR RECORDER (inline)
 // ============================================================================
+/**
+ * Headers redacted before being written to HAR entries (FIX M2).
+ * Mirrors logging.ts DEFAULT_REDACT_HEADERS — HAR logs are routinely exported
+ * and shared, so credentials must never appear verbatim.
+ */
+const HAR_REDACT_HEADERS = new Set([
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key",
+    "x-auth-token",
+    "x-access-token",
+    "x-refresh-token",
+    "x-csrf-token",
+    "x-session-id",
+    "x-session-token",
+    "x-secret",
+    "x-secret-key",
+    "x-private-key",
+    "api-key",
+    "apikey",
+    "bearer",
+    "token",
+    "authentication",
+    "credentials",
+    "password",
+    "passwd",
+    "secret",
+]);
+/** Redact a single header value for HAR output. */
+function redactHARHeader(name, value) {
+    return HAR_REDACT_HEADERS.has(name.toLowerCase()) ? { name, value: "***REDACTED***" } : { name, value };
+}
 /**
  * O(1) ring-buffer HAR entry recorder.
  * Stores up to `maxEntries` entries, evicting oldest first.
@@ -192,7 +226,7 @@ class HARRecorder {
                 method: req.method,
                 url: req.url,
                 httpVersion: res.httpVersion,
-                headers: Object.entries(req.headers).map(([name, value]) => ({ name, value })),
+                headers: Object.entries(req.headers).map(([name, value]) => redactHARHeader(name, value)),
                 queryString: (() => {
                     try {
                         return Array.from(new URL(req.url).searchParams.entries()).map(([name, value]) => ({
@@ -220,7 +254,7 @@ class HARRecorder {
                 status: res.status,
                 statusText: res.statusText,
                 httpVersion: res.httpVersion,
-                headers: Object.entries(res.headers).map(([name, value]) => ({ name, value })),
+                headers: Object.entries(res.headers).map(([name, value]) => redactHARHeader(name, value)),
                 content: {
                     size: res.rawBody?.byteLength ?? 0,
                     mimeType: res.headers["content-type"] ?? "application/octet-stream",
@@ -279,7 +313,14 @@ async function applyAuth(req, auth) {
     switch (auth.type) {
         case "bearer": {
             const token = typeof auth.token === "function" ? await auth.token() : auth.token;
-            headers["authorization"] = `Bearer ${token}`;
+            // FIX (H3): token values — especially from async providers — must be
+            // validated before injection. A token containing CRLF would split or
+            // forge headers on the wire (header injection).
+            const headerValue = `Bearer ${token}`;
+            if (!isValidHeaderValue(headerValue)) {
+                throw new KinetexError("Invalid bearer token — contains forbidden characters (CRLF/CTL)", "EVALIDATION");
+            }
+            headers["authorization"] = headerValue;
             break;
         }
         case "basic": {
@@ -303,7 +344,17 @@ async function applyAuth(req, auth) {
         }
         case "apikey": {
             const key = typeof auth.key === "function" ? await auth.key() : auth.key;
-            headers[auth.header.toLowerCase()] = key;
+            // FIX (LOW): validate the custom header name — an apikey header containing
+            // CRLF or spaces would be injected verbatim into the request.
+            if (!isValidHeaderName(auth.header)) {
+                throw new KinetexError(`Invalid apikey auth header name: "${auth.header}"`, "EVALIDATION");
+            }
+            // FIX (H3): the key value is equally attacker-influenced when provided
+            // via an async provider — validate before injection.
+            if (!isValidHeaderValue(String(key))) {
+                throw new KinetexError(`Invalid apikey value for "${auth.header}" — contains forbidden characters`, "EVALIDATION");
+            }
+            headers[auth.header.toLowerCase()] = String(key);
             break;
         }
         case "digest": {
@@ -328,6 +379,46 @@ async function applyAuth(req, auth) {
 // ============================================================================
 // §5  URL BUILDING
 // ============================================================================
+/**
+ * Headers stripped when a redirect crosses origins (FIX H2).
+ * These carry credentials and must never be forwarded to a different origin.
+ */
+const CROSS_ORIGIN_STRIP_HEADERS = new Set([
+    "authorization",
+    "cookie",
+    "proxy-authorization",
+    "x-api-key",
+    "x-auth-token",
+    "x-access-token",
+    "x-refresh-token",
+    "x-csrf-token",
+    "x-session-id",
+    "x-session-token",
+    "x-secret",
+    "x-secret-key",
+    "x-private-key",
+    "api-key",
+    "apikey",
+    "www-authenticate",
+]);
+/**
+ * Strip userinfo (user:pass@) from a URL string for safe error messages (FIX M5).
+ * Falls back to a regex strip when the URL cannot be parsed.
+ */
+function redactUserInfo(url) {
+    try {
+        const u = new URL(url);
+        if (u.username || u.password) {
+            u.username = "";
+            u.password = "";
+            return u.toString();
+        }
+        return url;
+    }
+    catch {
+        return url.replace(/\/\/[^/@]*@/, "//");
+    }
+}
 /**
  * Resolve a URL against an optional base and append query parameters.
  * Rejects unsafe URLs (private/loopback addresses). Enforces query param
@@ -368,7 +459,7 @@ function buildURL(base, url, params) {
     }
     if (!params || Object.keys(params).length === 0) {
         if (!isSafeURL(full)) {
-            throw new KinetexError(`URL "${full}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
+            throw new KinetexError(`URL "${redactUserInfo(full)}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
         }
         return full;
     }
@@ -405,7 +496,7 @@ function buildURL(base, url, params) {
         }
         // Validate the final URL with params
         if (!isSafeURL(result)) {
-            throw new KinetexError(`URL "${result}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
+            throw new KinetexError(`URL "${redactUserInfo(result)}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
         }
         return result;
     }
@@ -448,6 +539,11 @@ function buildURL(base, url, params) {
         if (result.length > MAX_URL_LENGTH) {
             throw new KinetexError(`URL length ${result.length} bytes exceeds limit of ${MAX_URL_LENGTH} bytes`, "EVALIDATION");
         }
+        // FIX M4: the manual param-concat fallback previously returned WITHOUT a
+        // safety check — validate the assembled URL like every other path.
+        if (!isSafeURL(result)) {
+            throw new KinetexError(`URL "${redactUserInfo(result)}" failed safety check — blocked private/loopback address or forbidden scheme`, "EVALIDATION");
+        }
         return result;
     }
 }
@@ -1293,6 +1389,16 @@ export class Kinetex {
         }
         // ── Build initial request ─────────────────────────────────────────────
         const fullUrl = buildURL(options.baseURL ?? this.cfg.baseURL, url, mergeParams(this.cfg.params, options.params));
+        // FIX (M7): proxy configuration was stored but never consumed — a silent
+        // no-op that sent traffic directly to the target, bypassing the user's
+        // proxy entirely. Fail fast with actionable guidance instead.
+        const proxy = options.proxy ?? this.cfg.proxy;
+        if (proxy) {
+            throw new KinetexError("proxy is configured but kinetex's built-in transports cannot route through it: " +
+                "HTTP(S) proxies require a custom fetch with a proxy agent (e.g. undici ProxyAgent " +
+                "passed via the `fetch` option), and SOCKS5 requires createSocks5Tunnel() from " +
+                "kinetex/socks5. Set up one of those instead of relying on `proxy` silently doing nothing.", "EVALIDATION");
+        }
         // Enforce HTTPS-only if configured
         if (this.cfg.httpsOnly) {
             try {
@@ -1323,12 +1429,39 @@ export class Kinetex {
             else if (options.body instanceof Blob) {
                 bodySize = options.body.size;
             }
+            else if (ArrayBuffer.isView(options.body)) {
+                // FIX (H4): other typed-array/DataView views were uncounted.
+                // ArrayBuffer.isView() is used instead of `instanceof ArrayBufferView`
+                // because there is no runtime global to instanceof against.
+                bodySize = options.body.byteLength;
+            }
+            else if (options.body instanceof URLSearchParams) {
+                // FIX (H4): previously silently skipped — count the serialized form.
+                bodySize = new TextEncoder().encode(options.body.toString()).byteLength;
+            }
             else if (options.body instanceof FormData) {
-                // FormData size estimation is complex, skip for now
-                // In practice, browsers enforce their own limits
+                // FIX (H4): estimate multipart size instead of skipping entirely —
+                // the old skip allowed unbounded uploads past the configured limit.
+                const boundaryOverhead = 76; // per part: --boundary, headers, CRLF (conservative)
+                for (const [name, value] of options.body) {
+                    bodySize += new TextEncoder().encode(name).byteLength + boundaryOverhead;
+                    if (typeof value === "string") {
+                        bodySize += new TextEncoder().encode(value).byteLength;
+                    }
+                    else {
+                        bodySize += value.size;
+                    }
+                }
+                bodySize += boundaryOverhead; // final boundary
+            }
+            else if (options.body instanceof ReadableStream) {
+                // FIX (H4): a stream's size cannot be known without consuming it —
+                // reject rather than silently bypassing the limit. Callers who need
+                // streaming uploads must pass maxRequestSize: 0 explicitly.
+                throw new KinetexError(`maxRequestSize cannot be enforced for ReadableStream bodies — pass maxRequestSize: 0 to opt out, or buffer the body first`, "EVALIDATION");
             }
             else if (options.body && typeof options.body === "object") {
-                bodySize = JSON.stringify(options.body).length;
+                bodySize = new TextEncoder().encode(JSON.stringify(options.body)).byteLength;
             }
             if (bodySize > maxRequestSize) {
                 throw new KinetexError(`Request body size ${bodySize} bytes exceeds limit of ${maxRequestSize} bytes`, "EVALIDATION");
@@ -1559,12 +1692,33 @@ export class Kinetex {
     async _sendFollowingRedirects(req, timeout, jar, appliedAuth) {
         const MAX_REDIRECTS = 20;
         let currentReq = { ...req, redirect: "manual" };
+        const origin0 = (() => {
+            try {
+                return new URL(req.url).origin;
+            }
+            catch {
+                return null;
+            }
+        })();
         // Track visited URLs to detect redirect loops
         const visited = new Set();
         for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-            // Apply auth headers on every hop (they may have been lost during redirect)
+            // FIX H2 (part 2): re-apply auth on every hop ONLY while we remain on the
+            // original origin. Once a redirect has crossed origins, credential-bearing
+            // headers must not be re-injected — otherwise the cross-origin strip in
+            // the redirect branch below would be immediately undone.
             if (hop > 0 && appliedAuth) {
-                currentReq = await applyAuth(currentReq, appliedAuth);
+                const sameOrigin = (() => {
+                    try {
+                        return new URL(currentReq.url).origin === origin0;
+                    }
+                    catch {
+                        return false;
+                    }
+                })();
+                if (sameOrigin) {
+                    currentReq = await applyAuth(currentReq, appliedAuth);
+                }
             }
             // Fire request interceptors and onBeforeRequest hooks on every hop
             // so auth headers, logging, and tracing apply to redirect legs too.
@@ -1656,6 +1810,21 @@ export class Kinetex {
                 else {
                     delete nextHeaders["cookie"];
                 }
+                // FIX H2: When the redirect crosses origins, strip credential-bearing
+                // headers (Authorization, Cookie, proxy auth, API keys) so secrets are
+                // never forwarded to a different origin (RFC 9110 7.1 semantics).
+                // Cookies for the new origin are re-established by the jar lookup above;
+                // jar scoping guarantees only same-site cookies apply.
+                try {
+                    if (new URL(nextUrl).origin !== new URL(currentReq.url).origin) {
+                        for (const h of CROSS_ORIGIN_STRIP_HEADERS) {
+                            delete nextHeaders[h];
+                        }
+                    }
+                }
+                catch {
+                    /* nextUrl was already validated above */
+                }
                 currentReq = {
                     ...currentReq,
                     url: nextUrl,

package/dist/cjs/cookie-store.js

@@ -311,6 +311,16 @@ export class CookieJar {
                     // §5.4 step 2e: SameSite
                     if (!sameSiteAllows(cookie.sameSite, context))
                         continue;
+                    // FIX (H5): defense-in-depth — re-validate __Secure-/__Host- prefix
+                    // rules at retrieval time. Set-time enforcement (enforcePrefixRules)
+                    // is the RFC rule, but storage can be rehydrated via loadCookieJar
+                    // from external JSON, so never emit a prefix cookie whose Secure/
+                    // Path/hostOnly flags no longer satisfy the contract.
+                    if (cookie.name.startsWith("__Secure-") && !(cookie.secure && isSecure))
+                        continue;
+                    if (cookie.name.startsWith("__Host-") &&
+                        !(cookie.secure && isSecure && cookie.path === "/" && cookie.hostOnly))
+                        continue;
                     result.push(cookie);
                 }
             }

package/dist/cjs/core.js

@@ -466,13 +466,19 @@ export class NodeHTTP2Transport {
                         }
                     }
                     if (hasForbidden) {
+                        if (this._strict) {
+                            throw new KinetexError(`Strict mode: header "${hName}" contains forbidden control characters`, "EVALIDATION", { request: currentReq });
+                        }
+                        // FIX (H3): non-strict mode must match FetchTransport behavior —
+                        // notify the callback (if any) and warn, never drop silently.
                         if (this._onDroppedHeader) {
                             this._onDroppedHeader(hName, hStr);
-                            delete h2ReqHeaders[hName];
                         }
-                        else {
-                            throw new KinetexError(`Strict mode: header "${hName}" contains forbidden control characters`, "EVALIDATION", { request: currentReq });
+                        else if (typeof console !== "undefined") {
+                            console.warn(`[kinetex] Invalid header dropped (HTTP/2): "${hName}" — value contains illegal control characters. ` +
+                                `Pass strictHeaders: true to throw instead.`);
                         }
+                        delete h2ReqHeaders[hName];
                     }
                 }
             }
@@ -713,9 +719,14 @@ export class NodeHTTP2Transport {
  * @param transportOptions - Header validation options (strict mode, dropped-header callback).
  */
 export function createTransport(fetchFn, preferHTTP2 = true, sessionOptions, transportOptions) {
-    // Use NodeHTTP2Transport for Node.js when HTTP/2 is preferred
-    // Falls back to FetchTransport for HTTP/1.1 or non-Node runtimes
-    if (IS_NODE && preferHTTP2) {
+    // FIX (M7-class silent no-op): a custom `fetch` config was silently ignored on
+    // Node.js when HTTP/2 was preferred (the default) — NodeHTTP2Transport has no
+    // fetchFn input, so the caller's fetch was never used. When a custom fetch is
+    // supplied, always route through FetchTransport so the documented
+    // "Custom fetch implementation" behavior holds on every runtime.
+    // Use NodeHTTP2Transport for Node.js when HTTP/2 is preferred and no custom
+    // fetch is given. Falls back to FetchTransport otherwise.
+    if (IS_NODE && preferHTTP2 && !fetchFn) {
         return new NodeHTTP2Transport({
             ...(sessionOptions?.sessionTTLMs !== undefined
                 ? { sessionTTLMs: sessionOptions.sessionTTLMs }
@@ -767,8 +778,14 @@ export async function sendWithTimeout(transport, request, timeoutMs) {
     // Merge signals
     const signal = mergeSignals(request.signal, controller.signal) ?? null;
     const req = { ...request, signal };
+    const timeoutPromise = new Promise((_, reject) => {
+        controller.signal.addEventListener("abort", () => reject(new TimeoutError(timeoutMs, request)), { once: true });
+    });
     try {
-        const result = await transport.send(req);
+        // Race the transport against the timer. The race is the actual deadline
+        // — a transport that never resolves (or ignores the abort signal) can no
+        // longer hang the caller past timeoutMs.
+        const result = await Promise.race([transport.send(req), timeoutPromise]);
         clearTimeout(timer);
         // Safety net: the transport may have resolved despite the abort signal
         // (e.g. Node.js HTTP/2 'close' fires before 'error' in some versions).
@@ -780,7 +797,7 @@ export async function sendWithTimeout(transport, request, timeoutMs) {
     }
     catch (err) {
         clearTimeout(timer);
-        if (controller.signal.aborted) {
+        if (controller.signal.aborted && !(err instanceof TimeoutError)) {
             throw new TimeoutError(timeoutMs, request);
         }
         throw err;

package/dist/cjs/graphql.js

@@ -27,6 +27,9 @@
  *  - Retry on network error
  */
 import { ValidationError } from "./types.js";
+// FIX (H6): untrusted GraphQL responses are parsed with raw JSON.parse below —
+// sanitize prototype-pollution keys before they reach user code or merges.
+import { sanitizeParsedJSON } from "./utils.js";
 // ============================================================================
 // §2  ERRORS
 // ============================================================================
@@ -307,11 +310,20 @@ function setNestedValue(obj, path, value) {
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const key = parts[i];
+        // FIX (H6): reject prototype-pollution path segments — a GraphQL upload
+        // path like "__proto__.polluted" must never write through the prototype.
+        if (key === "__proto__" || key === "constructor" || key === "prototype") {
+            throw new ValidationError(`Invalid upload path: "${path}" — reserved key "${key}"`);
+        }
         if (!current[key] || typeof current[key] !== "object")
             current[key] = {};
         current = current[key];
     }
-    current[parts[parts.length - 1]] = value;
+    const leaf = parts[parts.length - 1];
+    if (leaf === "__proto__" || leaf === "constructor" || leaf === "prototype") {
+        throw new ValidationError(`Invalid upload path: "${path}" — reserved key "${leaf}"`);
+    }
+    current[leaf] = value;
 }
 // ============================================================================
 // §8  RESPONSE HANDLING
@@ -324,7 +336,8 @@ async function parseGraphQLResponse(response, req) {
     }
     let json;
     try {
-        json = (await response.json());
+        // FIX (H6): sanitize untrusted response JSON before it reaches user code.
+        json = sanitizeParsedJSON((await response.json()));
     }
     catch (err) {
         throw new GraphQLClientError("Failed to parse GraphQL response as JSON", "EPARSE", undefined, req, undefined, err);
@@ -679,7 +692,8 @@ export class GraphQLClient {
         catch (err) {
             throw new GraphQLClientError(err instanceof Error ? err.message : "Batch network error", "ENETWORK", undefined, requests[0], undefined, err);
         }
-        const rawResults = await response.json();
+        // FIX (H6): sanitize untrusted batch response JSON before validation.
+        const rawResults = sanitizeParsedJSON(await response.json());
         // Validate response is array (B-5 fix)
         if (!Array.isArray(rawResults)) {
             throw new GraphQLClientError("Batch response must be an array of GraphQL responses", "EINVALIDRESPONSE", undefined, requests[0], rawResults);
@@ -771,7 +785,7 @@ export class GraphQLClient {
                 continue;
             let gqlRes;
             try {
-                gqlRes = JSON.parse(event.data);
+                gqlRes = sanitizeParsedJSON(JSON.parse(event.data));
             }
             catch {
                 continue;

package/dist/cjs/logging.js

@@ -25,6 +25,9 @@
  * consider using external log rotation (e.g., logrotate) or shipping logs
  * to a remote service (RemoteTransport) rather than writing to files.
  */
+// FIX (H6): logged bodies are untrusted — parsed JSON is stripped of
+// prototype-pollution keys before redaction writes (see sanitizeParsedJSON).
+import { sanitizeParsedJSON } from "./utils.js";
 // Cross-runtime: safely detect Node.js process.env
 const getNodeEnv = () => {
     try {
@@ -483,7 +486,9 @@ export class Redactor {
         // Redact body fields (JSON)
         if (ct.includes("application/json") && this.bodyFields.length > 0) {
             try {
-                const parsed = JSON.parse(str);
+                // FIX (H6): log bodies are untrusted — sanitize before mutation so a
+                // crafted payload cannot smuggle __proto__ paths into redaction writes.
+                const parsed = sanitizeParsedJSON(JSON.parse(str));
                 for (const path of this.bodyFields)
                     redactObjectPath(parsed, path.split("."));
                 str = JSON.stringify(parsed);
@@ -510,9 +515,12 @@ function redactObjectPath(obj, path) {
     const [head, ...rest] = path;
     if (head === undefined)
         return;
+    // FIX (H6): never traverse or write through prototype-pollution keys.
+    if (head === "__proto__" || head === "constructor" || head === "prototype")
+        return;
     const o = obj;
     if (rest.length === 0) {
-        if (head in o)
+        if (Object.prototype.hasOwnProperty.call(o, head))
             o[head] = "***";
         return;
     }

package/dist/cjs/mod.js

@@ -95,4 +95,4 @@ export { HookRegistry, HookEmitter } from "./lifecycle.js";
 export { CircuitBreaker, CircuitBreakerRegistry, CircuitOpenError, createCircuitBreaker, createCircuitBreakerRegistry, } from "./circuit-breaker.js";
 export { DedupMap, createDedupMap } from "./dedup.js";
 // ── Utilities ────────────────────────────────────────────────────────────────
-export { safeJSONParse, tryParseJSON, parseUntrustedJSON, isUint8Array, isArrayBuffer, isReadableStream, isHeaders, isAbortSignal, isPlainObject, isFormData, isBlob, isURLSearchParams, isValidHeaderName, isValidHeaderValue, isSafeURL, sanitizeURL, createStructuredError, formatError, perfNow, sleep, concatUint8Arrays, toUint8Array, uint8ArrayToBase64, deepClone, normalizeHeaders, mergeSignals, isAbortError, getRuntime, isNodeEnvironment, isBrowserEnvironment, hasNativeFetch, } from "./utils.js";
+export { safeJSONParse, tryParseJSON, parseUntrustedJSON, sanitizeParsedJSON, isUint8Array, isArrayBuffer, isReadableStream, isHeaders, isAbortSignal, isPlainObject, isFormData, isBlob, isURLSearchParams, isValidHeaderName, isValidHeaderValue, isSafeURL, sanitizeURL, createStructuredError, formatError, perfNow, sleep, concatUint8Arrays, toUint8Array, uint8ArrayToBase64, deepClone, normalizeHeaders, mergeSignals, isAbortError, getRuntime, isNodeEnvironment, isBrowserEnvironment, hasNativeFetch, } from "./utils.js";

package/dist/cjs/pagination.js

@@ -22,6 +22,9 @@
  *  - Per-page transform / filter
  *  - Pagination state serialization (resume support)
  */
+// FIX (H6): serialized pagination state may come from untrusted URLs —
+// parsed JSON is stripped of prototype-pollution keys (see sanitizeParsedJSON).
+import { sanitizeParsedJSON } from "./utils.js";
 // ============================================================================
 // §2  INITIAL STATE BUILDER
 // ============================================================================
@@ -457,7 +460,9 @@ export function serializePaginationState(state) {
  */
 export function deserializePaginationState(serialized) {
     try {
-        return JSON.parse(atob(serialized));
+        // FIX (H6): serialized state can originate from untrusted URLs/clients —
+        // strip prototype-pollution keys before the state is spread into requests.
+        return sanitizeParsedJSON(JSON.parse(atob(serialized)));
     }
     catch {
         throw new Error("Invalid pagination state string");

package/dist/cjs/response.js

@@ -150,7 +150,9 @@ export class ResponseDecodeError extends Error {
  * Normalize a fetch Response headers to a plain object.
  */
 // FIX 12: normalizeHeaders centralised in utils.ts.
-import { normalizeHeaders as _normalizeHeadersUtil } from "./utils.js";
+// FIX (H6): sanitizeParsedJSON strips __proto__/constructor/prototype keys
+// from freshly parsed JSON so untrusted payloads cannot pollute prototypes.
+import { normalizeHeaders as _normalizeHeadersUtil, sanitizeParsedJSON as _sanitizeParsedJSON, } from "./utils.js";
 /** @deprecated use normalizeHeaders from utils.ts directly */
 export function normalizeHeaders(headers) {
     return _normalizeHeadersUtil(headers);
@@ -526,7 +528,7 @@ export async function readJSON(response, options = {}) {
     const charset = options.charset ?? parseContentType(ct ?? "")?.charset ?? null;
     const text = decodeBody(bytes, charset, url);
     try {
-        return JSON.parse(text);
+        return _sanitizeParsedJSON(JSON.parse(text));
     }
     catch (err) {
         throw new ResponseDecodeError(`JSON parse failed: ${err}`, "json", url);
@@ -624,7 +626,7 @@ export async function* readNDJSON(response, options = {}) {
                 const trimmed = buffer.trim();
                 if (trimmed) {
                     try {
-                        yield JSON.parse(trimmed);
+                        yield _sanitizeParsedJSON(JSON.parse(trimmed));
                     }
                     catch (err) {
                         options.onParseError?.(err, trimmed);
@@ -640,7 +642,7 @@ export async function* readNDJSON(response, options = {}) {
                 if (!trimmed || trimmed.startsWith("#"))
                     continue;
                 try {
-                    yield JSON.parse(trimmed);
+                    yield _sanitizeParsedJSON(JSON.parse(trimmed));
                 }
                 catch (err) {
                     options.onParseError?.(err, trimmed);
@@ -699,7 +701,7 @@ export async function* readJSONStream(response, options = {}) {
                 const remaining = flushBuffer();
                 if (remaining) {
                     try {
-                        const obj = JSON.parse(remaining);
+                        const obj = _sanitizeParsedJSON(JSON.parse(remaining));
                         options.onObject?.(obj);
                         yield obj;
                     }
@@ -722,7 +724,7 @@ export async function* readJSONStream(response, options = {}) {
                     if (depth === 0 && startIdx !== -1) {
                         const objStr = buffer.slice(startIdx, i + 1);
                         try {
-                            const obj = JSON.parse(objStr);
+                            const obj = _sanitizeParsedJSON(JSON.parse(objStr));
                             options.onObject?.(obj);
                             yield obj;
                         }

package/dist/cjs/sse.js

@@ -26,6 +26,9 @@
  *   limit and 15min wall-clock time limit. Long-lived SSE connections may be terminated
  *   by the platform. Consider using shorter-lived streams with client-side reconnection.
  */
+// FIX (H6): JSON event payloads from the server are untrusted — strip
+// prototype-pollution keys before handing parsed data to user handlers.
+import { sanitizeParsedJSON } from "./utils.js";
 // ============================================================================
 // §2  SSE PARSER (line-level state machine)
 // ============================================================================
@@ -522,7 +525,7 @@ export async function* jsonSSE(source, options = {}) {
         if (!evt.data && evt.data !== "")
             continue;
         try {
-            const data = JSON.parse(evt.data, options.reviver);
+            const data = sanitizeParsedJSON(JSON.parse(evt.data, options.reviver));
             yield { event: evt.event, data, id: evt.id };
         }
         catch (err) {
@@ -563,7 +566,7 @@ export class SSERouter {
     onJSON(eventType, handler) {
         return this.on(eventType, async (data, evt) => {
             try {
-                const parsed = JSON.parse(data);
+                const parsed = sanitizeParsedJSON(JSON.parse(data));
                 await handler(parsed, evt);
             }
             catch {