kinetex 1.4.0 → 1.5.0

package/dist/cjs/cookie-parser.js

@@ -1567,10 +1567,21 @@ function decodePunycode(input) {
         const initialN = 0x80;
         const delim = input.lastIndexOf("-");
         const output = [];
+        // RFC 3492 §6.2: the basic part is everything before the *last* delimiter,
+        // so it may contain any basic code point — "-" included. Testing it for
+        // alphanumerics only rejected legal input: "xn--abc-def-" and "xn--a--"
+        // both carry a hyphen inside their basic part, and were returned
+        // undecoded. That left the A-label and its U-label looking like two
+        // different cookie domains, so one host could be registered twice.
+        //
+        // The decoder only ever inserts code points >= initialN (0x80), so the
+        // result can never contain a "." and cannot re-split the domain. Control
+        // characters and non-ASCII are still refused, since neither is a basic
+        // code point and both would be unsafe in a canonicalized cookie domain.
         const basic = delim >= 0 ? input.slice(0, delim) : "";
         for (let j = 0; j < basic.length; j++) {
             const cp = basic.charCodeAt(j);
-            if (cp > 0x7a || (cp > 0x5a && cp < 0x61) || (cp > 0x39 && cp < 0x41) || cp < 0x30)
+            if (cp >= 0x80 || cp < 0x20 || cp === 0x7f)
                 return input;
             output.push(cp);
         }
@@ -1647,6 +1658,22 @@ let _domainToUnicode;
  * @returns Decoded label (e.g., "中国") or original if not punycode
  */
 export function decodeIDNLabel(label) {
+    // A dotted input is a domain, not a single label. Split it and decode each
+    // label, so a full domain answers the same however many labels it has and
+    // whichever decoder ends up handling it.
+    //
+    // This has to happen before the `xn--` test below. Previously a dotted input
+    // that did not *begin* with `xn--` — "sub.xn--bcdf-zna1d.co.uk" — returned
+    // untouched, and one that did was handed whole to the single-label decoder,
+    // which failed on the dot. Whether the lazily-imported `node:url` helper had
+    // resolved decided which of those happened, so the same input could decode or
+    // not depending on module load timing.
+    if (label.includes(".")) {
+        return label
+            .split(".")
+            .map((part) => decodeIDNLabel(part))
+            .join(".");
+    }
     if (!label.toLowerCase().startsWith("xn--")) {
         return label;
     }

package/dist/cjs/core.js

@@ -1,7 +1,7 @@
 // Node.js globals accessed via globalThis for cross-runtime compatibility
 const g = globalThis;
 import { KinetexError, TimeoutError, SizeLimitError } from "./types.js";
-import { concatUint8Arrays, mergeSignals, isAbortError, safeJSONParse, isSafeURL, randomBytes, } from "./utils.js";
+import { concatUint8Arrays, mergeSignals, isAbortError, safeJSONParse, isSafeURL, isBlockedAddress, randomBytes, } from "./utils.js";
 import { isValidHeaderName, isValidHeaderValue } from "./headers.js";
 // ============================================================================
 // §1  RUNTIME DETECTION
@@ -137,6 +137,13 @@ export class FetchTransport {
     strict;
     onDroppedHeader;
     dispatcher;
+    /** Per-request timeout; omitted means no timeout. */
+    requestTimeoutMs;
+    /**
+     * Permit connections to hosts resolving into private/loopback space.
+     * Default: false.
+     */
+    _allowPrivateNetwork;
     /**
      * @param fetchFnOrOptions - Custom fetch function or options object
      */
@@ -146,13 +153,75 @@ export class FetchTransport {
             this.strict = false;
             this.onDroppedHeader = undefined;
             this.dispatcher = undefined;
+            this.requestTimeoutMs = undefined;
+            this._allowPrivateNetwork = false;
         }
         else {
             this.fetchFn = fetchFnOrOptions.fetchFn ?? globalThis.fetch;
             this.strict = fetchFnOrOptions.strict ?? false;
             this.onDroppedHeader = fetchFnOrOptions.onDroppedHeader;
             this.dispatcher = fetchFnOrOptions.dispatcher;
+            this.requestTimeoutMs = fetchFnOrOptions.requestTimeoutMs;
+            this._allowPrivateNetwork = fetchFnOrOptions.allowPrivateNetwork ?? false;
+        }
+    }
+    /**
+     * Refuse a host that resolves into blocked address space.
+     *
+     * The Node transports close DNS rebinding properly: they resolve once and
+     * pin the checked address to the socket (`createPinnedLookup`). `fetch` has no
+     * resolver hook — undici owns the connection and exposes no way to install
+     * one — so the only place to intervene is before the call.
+     *
+     * That closes the case that matters in practice: a name resolving to loopback
+     * or the cloud metadata address is refused outright, which is the vector
+     * behind the classic SSRF-through-DNS attacks. What it cannot close is a
+     * resolver that answers public on this lookup and private on the connect a
+     * moment later. Closing *that* needs a resolver hook `fetch` does not offer,
+     * and claiming otherwise would be worse than saying so.
+     *
+     * The host has already passed the lexical screen by this point, so this is a
+     * second line of defence rather than the first.
+     */
+    async assertReachableHost(url) {
+        if (this._allowPrivateNetwork)
+            return;
+        // A caller-supplied `fetch` owns its own name resolution — its dispatcher,
+        // agent or resolver may answer something the system resolver never would,
+        // and vice versa. Screening the *system* answer for a name this transport
+        // will not resolve is theatre: it cannot observe the connection that
+        // actually happens, so it neither protects the caller nor describes the
+        // risk honestly. The lexical screen still applies to every URL, including
+        // redirects; the resolution half of the defence is the transport's job, and
+        // a custom one is the caller's.
+        if (this.fetchFn !== globalThis.fetch)
+            return;
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return; // Malformed URLs fail later, with a better message.
         }
+        if (!parsed.hostname || isIP(parsed.hostname))
+            return;
+        let addresses;
+        try {
+            // `all: true` so every candidate is inspected, matching what the socket
+            // would have been able to reach.
+            addresses = await new Promise((resolve, reject) => {
+                dnsLookup(parsed.hostname, { all: true }, (err, res) => err ? reject(err) : resolve(res));
+            });
+        }
+        catch {
+            // Resolution failed; let the request itself report it rather than
+            // inventing a different failure.
+            return;
+        }
+        const safe = filterSafeAddresses(addresses);
+        if (safe.length > 0)
+            return;
+        throw blockedHostError(url, addresses);
     }
     /**
      * Send a request via the native fetch() API.
@@ -165,6 +234,7 @@ export class FetchTransport {
      * @returns Raw response from the server
      */
     async send(req) {
+        await this.assertReachableHost(req.url);
         // Validate and sanitize headers to prevent injection attacks
         const sanitizedHeaders = {};
         for (const [name, value] of Object.entries(req.headers ?? {})) {
@@ -236,16 +306,48 @@ export class FetchTransport {
         if (this.dispatcher !== undefined) {
             init.dispatcher = this.dispatcher;
         }
+        // fetch() has no timeout of its own, so one is enforced here with an
+        // AbortController. Composed with the caller's signal rather than replacing
+        // it, so cancelling the caller still cancels the request.
+        const timeoutMs = this.requestTimeoutMs;
+        const timeoutCtl = timeoutMs === undefined ? undefined : new AbortController();
+        let timedOut = false;
+        const onCallerAbort = () => timeoutCtl?.abort();
+        if (timeoutCtl && req.signal) {
+            if (req.signal.aborted)
+                timeoutCtl.abort();
+            else
+                req.signal.addEventListener("abort", onCallerAbort, { once: true });
+        }
+        const timer = timeoutCtl && timeoutMs !== undefined
+            ? setTimeout(() => {
+                timedOut = true;
+                timeoutCtl.abort();
+            }, timeoutMs)
+            : undefined;
+        const initWithSignal = timeoutCtl && !init.signal ? { ...init, signal: timeoutCtl.signal } : init;
         let response;
         try {
-            response = await this.fetchFn(req.url, init);
+            response = await this.fetchFn(req.url, initWithSignal);
         }
         catch (err) {
+            // Clear the timer on every exit path, and drop the listener we added.
+            if (timer !== undefined)
+                clearTimeout(timer);
+            if (timeoutCtl && req.signal)
+                req.signal.removeEventListener("abort", onCallerAbort);
+            if (timedOut) {
+                throw new KinetexError(`HTTP/1.1 request to ${req.url} timed out after ${timeoutMs}ms`, "ETIMEOUT", { request: req, cause: err });
+            }
             if (isAbortError(err)) {
                 throw new KinetexError("Request was aborted", "EABORT", { request: req, cause: err });
             }
             throw new KinetexError(err instanceof Error ? err.message : "Network request failed", "ENETWORK", { request: req, cause: err });
         }
+        if (timer !== undefined)
+            clearTimeout(timer);
+        if (timeoutCtl && req.signal)
+            req.signal.removeEventListener("abort", onCallerAbort);
         const headers = normalizeHeaders(response.headers);
         const httpVersion = detectHTTPVersion(response, headers);
         // Determine if the runtime already decompressed the body.
@@ -319,6 +421,8 @@ export class NodeHTTP2Transport {
      * sockets, which is a lot to hold open for a legacy fallback), and gives
      * callers a way to opt out.
      */
+    /** Whether to permit connections into private/loopback address space. */
+    _allowPrivateNetwork;
     _http1KeepAlive;
     _http1MaxSockets;
     _http1Agent = null;
@@ -331,6 +435,7 @@ export class NodeHTTP2Transport {
         this.sessionTTLMs = options.sessionTTLMs ?? 5 * 60_000;
         this.pingIntervalMs = options.pingIntervalMs ?? 30_000;
         this.maxSessions = options.maxSessions ?? 100;
+        this._allowPrivateNetwork = options.allowPrivateNetwork ?? false;
         this._http1KeepAlive = options.http1KeepAlive ?? true;
         this._http1MaxSockets = options.http1MaxSockets ?? 16;
         this._proxy = options.proxy;
@@ -411,6 +516,9 @@ export class NodeHTTP2Transport {
         const session = await new Promise((resolve, reject) => {
             const s = http2.connect(origin, {
                 rejectUnauthorized: true,
+                // Resolve-and-check, so a hostname that points at a private address is
+                // refused before anything is dialled. See `createPinnedLookup`.
+                ...(this._allowPrivateNetwork ? {} : { lookup: PINNED_LOOKUP }),
                 ...(this._ca !== undefined ? { ca: this._ca } : {}),
                 // Already connected (and already TLS-wrapped for an https origin),
                 // so node:http2 must use it as-is rather than negotiating again.
@@ -813,6 +921,10 @@ export class NodeHTTP2Transport {
                 const opts = {
                     fetchFn: globalThis.fetch,
                     strict: this._strict,
+                    // The h2 path enforces `_requestTimeoutMs` itself; without passing it
+                    // down, `new NodeHTTP2Transport({ requestTimeoutMs: 500 })` hung for
+                    // the full response time on any non-https URL or HTTP/1.1 request.
+                    requestTimeoutMs: this._requestTimeoutMs,
                 };
                 if (this._onDroppedHeader !== undefined)
                     opts.onDroppedHeader = this._onDroppedHeader;
@@ -855,6 +967,8 @@ export class NodeHTTP2Transport {
             // private or self-signed peer could not be reached without disabling
             // verification process-wide.
             ...(this._ca !== undefined ? { ca: this._ca } : {}),
+            // Same reason as the HTTP/2 path above.
+            ...(this._allowPrivateNetwork ? {} : { lookup: PINNED_LOOKUP }),
         };
         return new Promise((resolve, reject) => {
             const httpReq = https.request(options, (httpRes) => {
@@ -1058,6 +1172,9 @@ export function createTransport(fetchFn, preferHTTP2 = true, sessionOptions, tra
                 ? { requestTimeoutMs: sessionOptions.requestTimeoutMs }
                 : {}),
             ...(transportOptions?.strict !== undefined ? { strict: transportOptions.strict } : {}),
+            ...(transportOptions?.allowPrivateNetwork !== undefined
+                ? { allowPrivateNetwork: transportOptions.allowPrivateNetwork }
+                : {}),
             ...(transportOptions?.onDroppedHeader !== undefined
                 ? { onDroppedHeader: transportOptions.onDroppedHeader }
                 : {}),
@@ -1074,6 +1191,12 @@ export function createTransport(fetchFn, preferHTTP2 = true, sessionOptions, tra
         ...(transportOptions?.dispatcher !== undefined
             ? { dispatcher: transportOptions.dispatcher }
             : {}),
+        // Reaches the pre-flight DNS screen in FetchTransport. It was accepted by
+        // createTransport and then dropped, so every fetch-based runtime silently
+        // had the screen off.
+        ...(transportOptions?.allowPrivateNetwork !== undefined
+            ? { allowPrivateNetwork: transportOptions.allowPrivateNetwork }
+            : {}),
     });
 }
 // ============================================================================
@@ -1175,11 +1298,19 @@ export async function readRawBody(stream, maxBytes, _url, signal) {
             const { done, value } = readResult;
             if (done)
                 break;
+            // Same policy as the readers in response.ts, reached through the same
+            // helper. The error class stays this entry point's own: `SizeLimitError`
+            // is a `KinetexError` carrying code `ESIZELIMIT`, where the response
+            // readers raise `ResponseSizeLimitError`, which is a bare `Error` with the
+            // same code. Both are public and documented, and merging them would be a
+            // breaking change, so the factory is passed in rather than shared.
             if (maxBytes > 0) {
-                const newTotal = total + value.byteLength;
-                if (newTotal > maxBytes) {
+                try {
+                    limitAction(value, total, { maxBytes }, "throw", (n, max) => new SizeLimitError(n, max));
+                }
+                catch (err) {
                     await reader.cancel("size limit exceeded");
-                    throw new SizeLimitError(newTotal, maxBytes);
+                    throw err;
                 }
             }
             chunks.push(value);
@@ -1275,7 +1406,98 @@ export function parseBody(raw, contentType, customParser, onParseFailure, header
 // §9  UTILITIES
 // ============================================================================
 // FIX 12: normalizeHeaders centralised in utils.ts.
+import { lookup as dnsLookup } from "node:dns";
+import { isIP } from "node:net";
+/** One instance, shared: it holds no per-request state. */
+const PINNED_LOOKUP = createPinnedLookup();
+/**
+ * A `lookup` for node:http and node:http2 that closes the DNS-rebinding gap.
+ *
+ * `isSafeURL` reads the hostname the caller wrote. The socket, however, is
+ * dialled at whatever that hostname *resolves to*, and nothing between the two
+ * points re-checked the answer — so a name that resolves to a public address on
+ * the first lookup and to `127.0.0.1` on the second reached a private service.
+ * That is DNS rebinding, and it needs an attacker-controlled resolver, which is
+ * an ordinary capability for whoever controls the domain being requested.
+ *
+ * Resolving here and pinning the result closes it for the connection that
+ * follows: every address the resolver returns is checked against the same
+ * blocklist `isSafeURL` applies to a literal, and only a checked address is
+ * handed back for the dial. A name that resolves solely to private space fails
+ * instead of connecting.
+ *
+ * The alternative — checking the hostname again after connecting — is too late:
+ * the request is already on the wire.
+ *
+ * `dns.lookup` (not `resolve`) is used deliberately: it honours `/etc/hosts`,
+ * the resolver search list and `dns.setDefaultResultOrder`, so a host pinned in
+ * the system file resolves the way it would have without this, and the address
+ * handed back is the one the socket would have reached anyway.
+ */
+/**
+ * Drop every resolved address that falls in a blocked range.
+ *
+ * Exported separately from `createPinnedLookup` so the decision can be tested
+ * against addresses a resolver would have to be trusted to produce: a name
+ * that answers with a public address and a private one is the rebinding case,
+ * and it cannot be arranged offline through a real resolver.
+ */
+export function filterSafeAddresses(addresses) {
+    return addresses.filter((a) => a.family !== 0 && !isBlockedAddress(a.address));
+}
+/**
+ * The refusal a host whose every resolved address is blocked earns.
+ *
+ * Split out from {@link FetchTransport} so the message and code can be
+ * asserted without arranging a resolver that answers with a blocked address.
+ */
+export function blockedHostError(url, addresses) {
+    return new KinetexError(`URL "${url}" resolved only to blocked addresses (${addresses.map((a) => a.address).join(", ") || "none"})`, "EBLOCKEDHOST");
+}
+export function createPinnedLookup() {
+    return (hostname, options, callback) => {
+        // Node's declared callback takes an address even on failure, and it ignores
+        // it — callers branch on `err` first. Node's own resolvers call back with
+        // the error alone, so this matches them rather than inventing a bogus
+        // address.
+        const fail = (err) => {
+            callback(err);
+        };
+        // `all: true` so every candidate is inspected. Node sets it when
+        // `autoSelectFamily` is on (the default since Node 20), in which case the
+        // callback expects an array; when it is not, a single address is expected.
+        const wantsAll = options.all === true;
+        // Typed as `LookupAllOptions` so TypeScript selects the overload that
+        // yields `LookupAddress[]`. Left as a plain object literal it picks the
+        // single-address overload, and `.filter` below does not exist on a string.
+        const resolved = { ...options, all: true };
+        dnsLookup(hostname, resolved, (err, addresses) => {
+            if (err) {
+                fail(err);
+                return;
+            }
+            const safe = filterSafeAddresses(addresses ?? []);
+            if (safe.length === 0) {
+                // Report it as a name-resolution failure rather than a connection
+                // error: nothing was dialled, and the distinction matters to a caller
+                // deciding whether to retry or to fail over.
+                const blocked = (addresses ?? []).map((a) => a.address).join(", ") || "no addresses";
+                const e = new Error(`Refusing to connect to ${hostname}: it resolves only to a blocked address (${blocked})`);
+                e.code = "EBLOCKEDHOST";
+                fail(e);
+                return;
+            }
+            if (wantsAll) {
+                callback(null, safe);
+                return;
+            }
+            const first = safe[0];
+            callback(null, first.address, first.family);
+        });
+    };
+}
 import { normalizeHeaders as _normalizeHeaders } from "./utils.js";
+import { limitAction } from "./response.js";
 /**
  * Normalize a Headers object to a plain record.
  *

package/dist/cjs/dedup.js

@@ -19,6 +19,81 @@
 // ============================================================================
 // §2  DEDUP MAP
 // ============================================================================
+/**
+ * Headers that are per-request noise rather than part of a request's identity.
+ *
+ * Two callers sending different trace ids are the same request as far as the
+ * response is concerned, so including them would only cost the coalescing that
+ * dedup exists to provide. Everything else — `Authorization`, `Cookie`,
+ * `Accept`, any custom header a gateway keys on — participates, so a request is
+ * only ever coalesced with one that would have received the same response.
+ */
+/**
+ * The default dedup key: method, URL, and the identity-bearing headers.
+ *
+ * Sorting makes the key order-independent, since two requests that differ only
+ * in header order are the same request. Values are included verbatim: a caller
+ * that wants coarser or finer granularity supplies a `keyFn`.
+ */
+/**
+ * Headers excluded from a request's identity, as with {@link defaultDedupKey}.
+ * Duplicated rather than imported so `dedup.ts` stays dependency-free; the two
+ * lists must be kept in step.
+ */
+const NON_IDENTITY_HEADERS = [
+    "traceparent",
+    "tracestate",
+    "baggage",
+    "x-request-id",
+    "x-correlation-id",
+    "x-trace-id",
+];
+/**
+ * A stable, opaque digest of everything that makes a request distinct.
+ *
+ * Hashing rather than concatenating keeps credentials out of the key: a dedup
+ * map is a long-lived map of strings, and its keys should not be a place where
+ * an `Authorization` header sits in plain text. Returns `""` when no header
+ * distinguishes the request, so the common unauthenticated case keys on method
+ * and URL alone.
+ */
+export async function identityFingerprint(headers) {
+    if (headers === undefined)
+        return "";
+    const lowered = new Map();
+    for (const [name, value] of Object.entries(headers)) {
+        lowered.set(name.toLowerCase(), value);
+    }
+    const parts = [];
+    for (const name of NON_IDENTITY_HEADERS)
+        lowered.delete(name);
+    for (const name of [...lowered.keys()].sort()) {
+        parts.push(`${name}=${lowered.get(name)}`);
+    }
+    if (parts.length === 0)
+        return "";
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(parts.join("|")));
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+/**
+ * Build a dedup key from a method, URL and identity digest.
+ */
+export function dedupKeyFrom(method, url, fingerprint) {
+    return fingerprint ? `${method}:${url}:${fingerprint}` : `${method}:${url}`;
+}
+export function defaultDedupKey(method, url, headers) {
+    if (headers === undefined)
+        return `${method}::${url}`;
+    const identity = Object.entries(headers)
+        .filter(([name]) => !NON_IDENTITY_HEADERS.includes(name.toLowerCase()))
+        .map(([name, value]) => `${name.toLowerCase()}=${value}`)
+        .sort();
+    // No distinguishing header means the key stays method + URL, so an empty
+    // header set does not silently become a different key shape.
+    return identity.length === 0 ? `${method}::${url}` : `${method}::${url}::${identity.join("&")}`;
+}
 /**
  * `DedupMap` manages in-flight promises keyed by a request fingerprint.
  * It is transport-agnostic — pass any async factory function.
@@ -26,6 +101,9 @@
 export class DedupMap {
     inflight = new Map();
     timeouts = new Map();
+    /** Window timers, overridable for tests. See {@link DedupOptions.timers}. */
+    _setTimeout;
+    _clearTimeout;
     windowMs;
     methods;
     keyFn;
@@ -39,8 +117,10 @@ export class DedupMap {
     constructor(options = {}) {
         this.windowMs = options.windowMs ?? 0;
         this.methods = new Set((options.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase()));
-        this.keyFn = options.keyFn ?? ((m, url) => `${m}::${url}`);
+        this.keyFn = options.keyFn ?? defaultDedupKey;
         this._globalSignal = options.signal ?? null;
+        this._setTimeout = options.timers?.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
+        this._clearTimeout = options.timers?.clearTimeout ?? ((h) => clearTimeout(h));
     }
     /**
      * Execute `factory` for the given method/url, or return the in-flight
@@ -64,9 +144,12 @@ export class DedupMap {
      * entry and creating a new one. The first caller becomes the "leader" and all
      * subsequent callers within the same tick share the same promise.
      *
-     * Note: The default `keyFn` does NOT include headers in the deduplication key.
-     * Two requests with different auth tokens to the same URL will NOT be deduplicated
-     * unless you provide a custom `keyFn` that includes headers.
+     * Note: the default key includes the request headers, so two requests to the
+     * same URL carrying different `Authorization` or `Cookie` are separate
+     * requests and are never coalesced. A key of method + URL alone was the
+     * default once, and it handed one caller's response to another: 50 callers
+     * aside, even two callers for different tenants shared a single response.
+     * See {@link defaultDedupKey}.
      */
     execute(method, url, factory, headers, windowMs, signal) {
         // Use per-key TTL if provided, otherwise fall back to global windowMs (F-3)
@@ -138,7 +221,7 @@ export class DedupMap {
                     this.inflight.delete(key);
                     const existingTimeout = this.timeouts.get(key);
                     if (existingTimeout !== undefined) {
-                        clearTimeout(existingTimeout);
+                        this._clearTimeout(existingTimeout);
                         this.timeouts.delete(key);
                     }
                 }
@@ -177,10 +260,10 @@ export class DedupMap {
                 // out from under callers that were sharing it.
                 const stale = this.timeouts.get(key);
                 if (stale !== undefined) {
-                    clearTimeout(stale);
+                    this._clearTimeout(stale);
                     this.timeouts.delete(key);
                 }
-                const timeoutId = setTimeout(() => {
+                const timeoutId = this._setTimeout(() => {
                     this.inflight.delete(key);
                     this.timeouts.delete(key);
                 }, effectiveWindowMs);
@@ -196,7 +279,7 @@ export class DedupMap {
                 this.inflight.delete(key);
             const existingTimeout = this.timeouts.get(key);
             if (existingTimeout !== undefined) {
-                clearTimeout(existingTimeout);
+                this._clearTimeout(existingTimeout);
                 this.timeouts.delete(key);
             }
             throw err;
@@ -254,7 +337,7 @@ export class DedupMap {
         this.inflight.clear();
         // Clear pending timeouts (B-1)
         for (const timeoutId of this.timeouts.values()) {
-            clearTimeout(timeoutId);
+            this._clearTimeout(timeoutId);
         }
         this.timeouts.clear();
     }
@@ -268,7 +351,7 @@ export class DedupMap {
     invalidate(key) {
         const timeoutId = this.timeouts.get(key);
         if (timeoutId) {
-            clearTimeout(timeoutId);
+            this._clearTimeout(timeoutId);
             this.timeouts.delete(key);
         }
         return this.inflight.delete(key);

package/dist/cjs/digest.js

@@ -9,6 +9,7 @@
  * Authorization header in one call.
  */
 import { randomBytes, uint8ArrayToBase64 } from "./utils.js";
+import { sha256Hex } from "./utils.js";
 // ============================================================================
 // §1  MD5 — Pure JS (no Web Crypto dependency)
 // ============================================================================
@@ -69,11 +70,14 @@ function md5(input) {
     for (let offset = 0; offset < bytes.length; offset += 64) {
         const M = [];
         for (let i = 0; i < 16; i++) {
-            const b0 = bytes[offset + i * 4];
-            const b1 = bytes[offset + i * 4 + 1];
-            const b2 = bytes[offset + i * 4 + 2];
-            const b3 = bytes[offset + i * 4 + 3];
-            M[i] = (b0 | (b1 << 8) | (b2 << 16) | (b3 << 24)) >>> 0;
+            // Named `w0..w3`, not `b0..b3`: `b0` shadowed the outer MD5 state variable
+            // of the same name, so the running state and the little-endian word read
+            // out of the block were indistinguishable at a glance.
+            const w0 = bytes[offset + i * 4];
+            const w1 = bytes[offset + i * 4 + 1];
+            const w2 = bytes[offset + i * 4 + 2];
+            const w3 = bytes[offset + i * 4 + 3];
+            M[i] = (w0 | (w1 << 8) | (w2 << 16) | (w3 << 24)) >>> 0;
         }
         let A = a0, B = b0, C = c0, D = d0;
         for (let i = 0; i < 64; i++) {
@@ -137,7 +141,7 @@ function md5(input) {
 function hexToBytes(hex) {
     const out = new Uint8Array(hex.length / 2);
     for (let i = 0; i < out.length; i++) {
-        out[i] = parseInt(hex.substr(i * 2, 2), 16);
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
     }
     return out;
 }
@@ -209,14 +213,6 @@ export function parseDigestChallenge(header) {
  * @param data - String to hash
  * @returns 64-char hex-encoded SHA-256 digest
  */
-async function sha256Hex(data) {
-    const enc = new TextEncoder();
-    const buf = await crypto.subtle.digest("SHA-256", enc.encode(data));
-    const bytes = new Uint8Array(buf);
-    return Array.from(bytes)
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
-}
 // ============================================================================
 // §3c  SHA-512/256 — Pure-JS (FIPS 180-4)
 // ============================================================================
@@ -700,12 +696,37 @@ export async function createDigestAuthorization(wwwAuth, username, password, met
  */
 export function createDigestAuthorizer() {
     const counters = new Map();
+    // The server chooses the nonce, and nonce expiry is a routine server-side
+    // control, so a long-lived client sees a fresh `realm\u0000nonce` key on every
+    // challenge. Entries were never evicted, so the map grew by one key per
+    // challenge for the life of the process — keyed on strings an
+    // attacker-influenced server supplies. `Map` preserves insertion order, so
+    // dropping the first key evicts the oldest challenge.
+    //
+    // ponytail: bounded LRU-by-insertion-order rather than a TTL timer. Raise
+    // MAX_TRACKED_NONCES if a deployment is ever seen cycling nonces faster
+    // than this; a timer per key would be the alternative.
+    const MAX_TRACKED_NONCES = 64;
+    const rememberNonce = (scope, value) => {
+        if (!counters.has(scope)) {
+            counters.set(scope, value);
+            if (counters.size > MAX_TRACKED_NONCES) {
+                const oldest = counters.keys().next();
+                if (!oldest.done)
+                    counters.delete(oldest.value);
+            }
+            return;
+        }
+        // Re-insert so a hot challenge counts as recently used.
+        counters.delete(scope);
+        counters.set(scope, value);
+    };
     return async (wwwAuth, username, password, method, uri) => {
         const challenge = parseDigestChallenge(wwwAuth);
         const cnonce = randomBytes(5);
         const scope = `${challenge.realm}\u0000${challenge.nonce}`;
         const next = (counters.get(scope) ?? 0) + 1;
-        counters.set(scope, next);
+        rememberNonce(scope, next);
         const nc = next.toString(16).padStart(8, "0");
         const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
         const usernameStar = await computeUsernameStar(challenge, username);