Summary
checkSignature verifies synchronously. It calls verifySignature in its three-argument form (src/signed-xml.ts#L372), including when it is given a callback, which it calls with the result before returning. Several places still describe asynchronous verification:
- The README's "Asynchronous signing and verification" section said
checkSignature could take a callback for asynchronous verification.
- The JSDoc of
checkSignature(xml, callback) said the callback handles "the validation result asynchronously".
SignatureAlgorithm declares a callback overload of verifySignature (src/types.ts#L196-L201) that SignedXml never calls.
Asynchronous verification is not being restored in 6.x. The documentation should describe the synchronous behavior. Removing the unused overload changes a public type, so it belongs with retiring the callback overloads in #546.
History
6.0.1, including the CVE-2025-29774 and CVE-2025-29775 fix (#494), passed the callback through to verifySignature. #489, which added getSignedReferences() and was released in 6.1.0 (#495 on master), replaced that with the synchronous call so it could clear signedReferences when verification failed. Asynchronous verification was not discussed there, and no test used it.
Summary
checkSignatureverifies synchronously. It callsverifySignaturein its three-argument form (src/signed-xml.ts#L372), including when it is given a callback, which it calls with the result before returning. Several places still describe asynchronous verification:checkSignaturecould take a callback for asynchronous verification.checkSignature(xml, callback)said the callback handles "the validation result asynchronously".SignatureAlgorithmdeclares a callback overload ofverifySignature(src/types.ts#L196-L201) thatSignedXmlnever calls.Asynchronous verification is not being restored in 6.x. The documentation should describe the synchronous behavior. Removing the unused overload changes a public type, so it belongs with retiring the callback overloads in #546.
History
6.0.1, including the CVE-2025-29774 and CVE-2025-29775 fix (#494), passed the callback through to
verifySignature. #489, which addedgetSignedReferences()and was released in 6.1.0 (#495 onmaster), replaced that with the synchronous call so it could clearsignedReferenceswhen verification failed. Asynchronous verification was not discussed there, and no test used it.