use replaceAll

signer.js

@@ -8,8 +8,6 @@
 
 const crypto = require('node:crypto')
 
-const base64PaddingRE = /=/gu
-
 function Signer (secrets, algorithm = 'sha256') {
   if (!(this instanceof Signer)) {
     return new Signer(secrets, algorithm)
@@ -45,12 +43,13 @@ function _sign (value, secret, algorithm) {
   if (typeof value !== 'string') {
     throw new TypeError('Cookie value must be provided as a string.')
   }
+
   return value + '.' + crypto
     .createHmac(algorithm, secret)
     .update(value)
     .digest('base64')
     // remove base64 padding (=) as it has special meaning in cookies
-    .replace(base64PaddingRE, '')
+    .replaceAll('=', '')
 }
 
 function _unsign (signedValue, secrets, algorithm) {
@@ -67,7 +66,8 @@ function _unsign (signedValue, secrets, algorithm) {
       .update(value)
       .digest('base64')
       // remove base64 padding (=) as it has special meaning in cookies
-      .replace(base64PaddingRE, ''))
+      .replaceAll('=', ''))
+
     if (
       expected.length === actual.length &&
       crypto.timingSafeEqual(expected, actual)