jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

@@ -1494,6 +1494,8 @@ operation.
     Count) Header Parameter value. The PBKDF2 iteration count defines the algorithm's computational
     expense.
     **Default:** '10000'
+  - `inflateRawSyncLimit`: `number` Limits compressed JWE plaintext output size.
+    **Default:** '250000'
   - `complete`: `<boolean>` When true returns an object with the parsed headers, verified
     AAD, the content encryption key, the key that was used to unwrap or derive the content
     encryption key, and cleartext instead of only the cleartext.

@@ -52,7 +52,7 @@ const validateAlgorithms = (algorithms, option) => {
 /*
  * @public
  */
-const jweDecrypt = (skipValidateHeaders, serialization, jwe, key, { crit = [], complete = false, keyManagementAlgorithms, contentEncryptionAlgorithms, maxPBES2Count = 10000 } = {}) => {
+const jweDecrypt = (skipValidateHeaders, serialization, jwe, key, { crit = [], complete = false, keyManagementAlgorithms, contentEncryptionAlgorithms, maxPBES2Count = 10000, inflateRawSyncLimit = 250000 } = {}) => {
   key = getKey(key, true)
 
   keyManagementAlgorithms = validateAlgorithms(keyManagementAlgorithms, 'keyManagementAlgorithms')
@@ -189,7 +189,7 @@ const jweDecrypt = (skipValidateHeaders, serialization, jwe, key, { crit = [], c
     let cleartext = decrypt(enc, cek, base64url.decodeToBuffer(ciphertext), { iv, tag, aad: adata })
 
     if (opts.zip) {
-      cleartext = inflateRawSync(cleartext)
+      cleartext = inflateRawSync(cleartext, { maxOutputLength: inflateRawSyncLimit })
     }
 
     if (complete) {

@@ -1,4 +1,5 @@
 const test = require('ava')
+const crypto = require('crypto')
 
 const base64url = require('../../lib/help/base64url')
 const { JWKS, JWK: { generateSync }, JWE, errors } = require('../..')
@@ -616,3 +617,25 @@ if (!('electron' in process.versions)) {
     }, { instanceOf: errors.JWEInvalid, message: 'JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds' })
   })
 }
+
+test('Compressed JWE output length limit', t => {
+  const k = generateSync('oct', 256)
+  {
+    const jwe = JWE.encrypt(crypto.randomBytes(250000), k, { alg: 'dir', enc: 'A128CBC-HS256', zip: 'DEF' })
+    t.notThrows(() => {
+      JWE.decrypt(jwe, k)
+    })
+  }
+  {
+    const jwe = JWE.encrypt(crypto.randomBytes(250000 + 1), k, { alg: 'dir', enc: 'A128CBC-HS256', zip: 'DEF' })
+    t.throws(() => {
+      JWE.decrypt(jwe, k)
+    })
+  }
+  {
+    const jwe = JWE.encrypt(crypto.randomBytes(1001), k, { alg: 'dir', enc: 'A128CBC-HS256', zip: 'DEF' })
+    t.throws(() => {
+      JWE.decrypt(jwe, k, { inflateRawSyncLimit: 1000 })
+    })
+  }
+})

@@ -402,6 +402,7 @@ export namespace JWE {
     contentEncryptionAlgorithms?: string[];
     keyManagementAlgorithms?: string[];
     maxPBES2Count?: number;
+    inflateRawSyncLimit?: number;
   }
 
   interface completeDecrypt {

@@ -0,0 +1,82 @@
+# Class: JWEDecompressionFailed
+
+## [💗 Help the project](https://github.com/sponsors/panva)
+
+Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by [becoming a sponsor](https://github.com/sponsors/panva).
+
+---
+
+An error subclass thrown when a JWE ciphertext decompression fails.
+
+**`Example`**
+
+Checking thrown error is this one using a stable error code
+
+```js
+if (err.code === 'ERR_JWE_DECOMPRESSION_FAILED') {
+  // ...
+}
+```
+
+**`Example`**
+
+Checking thrown error is this one using `instanceof`
+
+```js
+if (err instanceof jose.errors.JWEDecompressionFailed) {
+  // ...
+}
+```
+
+## Table of contents
+
+### Constructors
+
+- [constructor](util_errors.JWEDecompressionFailed.md#constructor)
+
+### Properties
+
+- [code](util_errors.JWEDecompressionFailed.md#code)
+- [message](util_errors.JWEDecompressionFailed.md#message)
+
+### Accessors
+
+- [code](util_errors.JWEDecompressionFailed.md#code-1)
+
+## Constructors
+
+### constructor
+
+• **new JWEDecompressionFailed**(`message?`)
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `message?` | `string` |
+
+## Properties
+
+### code
+
+• **code**: `string` = `'ERR_JWE_DECOMPRESSION_FAILED'`
+
+A unique error code for the particular error subclass.
+
+___
+
+### message
+
+• **message**: `string` = `'decompression operation failed'`
+
+## Accessors
+
+### code
+
+• `Static` `get` **code**(): ``"ERR_JWE_DECOMPRESSION_FAILED"``
+
+A unique error code for the particular error subclass.
+
+#### Returns
+
+``"ERR_JWE_DECOMPRESSION_FAILED"``

@@ -13,6 +13,7 @@ Support from the community to continue maintaining and improving this module is
 - [JOSEAlgNotAllowed](../classes/util_errors.JOSEAlgNotAllowed.md)
 - [JOSEError](../classes/util_errors.JOSEError.md)
 - [JOSENotSupported](../classes/util_errors.JOSENotSupported.md)
+- [JWEDecompressionFailed](../classes/util_errors.JWEDecompressionFailed.md)
 - [JWEDecryptionFailed](../classes/util_errors.JWEDecryptionFailed.md)
 - [JWEInvalid](../classes/util_errors.JWEInvalid.md)
 - [JWKInvalid](../classes/util_errors.JWKInvalid.md)

@@ -6,5 +6,6 @@ import type { InflateFunction, DeflateFunction } from '../../types.d'
 const inflateRaw = promisify(inflateRawCb)
 const deflateRaw = promisify(deflateRawCb)
 
-export const inflate: InflateFunction = (input: Uint8Array) => inflateRaw(input)
+export const inflate: InflateFunction = (input: Uint8Array) =>
+  inflateRaw(input, { maxOutputLength: 250_000 })
 export const deflate: DeflateFunction = (input: Uint8Array) => deflateRaw(input)

@@ -1,5 +1,7 @@
 import test from 'ava'
 import * as crypto from 'crypto'
+import { promisify } from 'node:util'
+import { inflateRaw as inflateRawCb } from 'node:zlib'
 
 const { FlattenedEncrypt, flattenedDecrypt } = await import('#dist')
 
@@ -228,3 +230,37 @@ test('decrypt PBES2 p2c limit', async (t) => {
     code: 'ERR_JWE_INVALID',
   })
 })
+
+test('decrypt inflate output length limit', async (t) => {
+  {
+    const jwe = await new FlattenedEncrypt(new Uint8Array(250000))
+      .setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256', zip: 'DEF' })
+      .encrypt(new Uint8Array(32))
+
+    await flattenedDecrypt(jwe, new Uint8Array(32))
+  }
+
+  {
+    const jwe = await new FlattenedEncrypt(new Uint8Array(250000 + 1))
+      .setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256', zip: 'DEF' })
+      .encrypt(new Uint8Array(32))
+
+    await t.throwsAsync(flattenedDecrypt(jwe, new Uint8Array(32)), {
+      message: 'decompression operation failed',
+      code: 'ERR_JWE_DECOMPRESSION_FAILED',
+    })
+  }
+
+  {
+    const jwe = await new FlattenedEncrypt(new Uint8Array(1000 + 1))
+      .setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256', zip: 'DEF' })
+      .encrypt(new Uint8Array(32))
+
+    const inflateRawPromise = promisify(inflateRawCb)
+    const inflateRaw = async (buffer) => inflateRawPromise(buffer, { maxOutputLength: 1000 })
+
+    await t.throwsAsync(flattenedDecrypt(jwe, new Uint8Array(32), { inflateRaw }), {
+      code: 'ERR_BUFFER_TOO_LARGE',
+    })
+  }
+})