AIKIDO-2026-778881

TL;DR

The CBOR map objects store decoded entries in a native PHP array keyed by each key's normalized value. Because PHP casts numeric strings to integers and rejects arrays used as offsets, structurally distinct keys such as the integer 1, the text string 1, and a byte string collapse onto one slot while an array or map key raises an uncaught TypeError. Decoding untrusted CBOR can therefore crash the process or silently overwrite earlier entries, producing parser-differential behavior in COSE and WebAuthn use. The fix records each occupied slot's major type and rejects colliding, duplicate, and non-scalar keys.