From ab4b9171fb35fb45db05ec007e2fc4fb66f393ad Mon Sep 17 00:00:00 2001
From: Ardis Lu <ardisglu@gmail.com>
Date: Wed, 17 Jun 2026 23:15:43 -0700
Subject: [PATCH] Clear `prf` on invalid chunk

Seems safer to just wipe it in case there is a scenario where a partial `prf` is sent.
---
 src/getPrf.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/getPrf.js b/src/getPrf.js
index 767629d..caa5257 100644
--- a/src/getPrf.js
+++ b/src/getPrf.js
@@ -143,6 +143,7 @@ export async function getPrf(options = {}) {
       request.on('data', chunk => {
         try { prf.set(chunk, offset); }
         catch { // Invalid chunk or too many bytes, stop processing immediately.
+          prf.fill(0);
           response.writeHead(400).end();
           request.destroy();
           return;
-- 
2.47.3