Fix abnormally large registration user IDs from Node Buffers

deno.json

@@ -62,6 +62,7 @@
     "@std/path": "jsr:@std/path@^1.0.8",
     "@std/semver": "jsr:@std/semver@^1.0.5",
     "@std/testing": "jsr:@std/testing@^1.0.4",
+    "@types/node": "npm:@types/node@^24.5.1",
     "jsdom": "npm:jsdom@^25.0.1",
     "rollup": "npm:rollup@^4.27.3",
     "rollup-plugin-version-injector": "npm:rollup-plugin-version-injector@^1.3.3",

packages/server/src/helpers/iso/isoBase64URL.ts

@@ -33,7 +33,12 @@ export function fromBuffer(
   buffer: Uint8Array_,
   to: 'base64' | 'base64url' = 'base64url',
 ): string {
-  return base64.fromArrayBuffer(buffer.buffer, to === 'base64url');
+  /**
+   * Gracefully handle Uint8Array subclass types, like Node's Buffer, that can have a large
+   * ArrayBuffer backing it.
+   */
+  const _normalized = new Uint8Array(buffer);
+  return base64.fromArrayBuffer(_normalized.buffer, to === 'base64url');
 }
 
 /**

packages/server/src/registration/generateRegistrationOptions.test.ts

@@ -1,5 +1,6 @@
 import { assertEquals, assertRejects } from '@std/assert';
 import { returnsNext, stub } from '@std/testing/mock';
+import { Buffer } from 'node:buffer';
 
 import { generateRegistrationOptions } from './generateRegistrationOptions.ts';
 import { _generateChallengeInternals } from '../helpers/generateChallenge.ts';
@@ -386,3 +387,16 @@ Deno.test('should map "remoteDevice" authenticator preference to hint and attach
   assertEquals(options.hints, ['hybrid']);
   assertEquals(options.authenticatorSelection?.authenticatorAttachment, 'cross-platform');
 });
+
+Deno.test('should generate a reasonable user.id when passed a Node Buffer', async () => {
+  const options = await generateRegistrationOptions({
+    rpID: 'not.real',
+    rpName: 'SimpleWebAuthn',
+    userName: 'usernameHere',
+    // @ts-ignore: Intentionally using a Node Buffer (which is a Uint8Array subclass)
+    userID: Buffer.from('someUserID', 'utf-8'),
+  });
+
+  assertEquals(options.user.id, 'c29tZVVzZXJJRA');
+  assertEquals(isoBase64URL.toUTF8String(options.user.id), 'someUserID');
+});