[BUG]: @octokit/webhooks signature verification fails for payloads containing emoji characters

[veraakarthikbharadwaj]

What happened?

Signature verification using @octokit/webhooks fails when the webhook payload contains multibyte UTF-8 characters (e.g., emojis like 😊)

const signature = req.headers['x-hub-signature-256'];

  try {
    // Validate the signature using the raw body
    const isValid = await webhooks.verify(req.rawBody.toString(), signature);

    if (!isValid) {
      logger.error('Invalid signature');
      return res.status(401).send('Invalid signature');
    }

    console.log('✅ Valid webhook signature');
    res.sendStatus(200);
  } catch (err) {
    console.error('Error verifying signature:', err);
    res.sendStatus(500);
  }

Versions

octokit/webhooks - 13.3.0
node version - v20

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[Ilia01]

This looks like a bytes-vs-string boundary bug more than a generic signature bug.

If the payload is signed over raw UTF-8 bytes, the safest comparison path is to hash the exact bytes that arrived, not a JS string that has already crossed a decode boundary.

Two concrete checks would isolate whether the mismatch is in @octokit/webhooks or in the request layer:

• compare verification over the raw Buffer / Uint8Array bytes vs req.rawBody.toString("utf8")
• log the byte length and digest for an ASCII-only payload vs the same payload with an emoji
• confirm the x-hub-signature-256 header still matches when you compute the HMAC over the exact bytes that arrived on the socket

I built HookLens for exactly this class of webhook debugging because once the body has crossed one decoding or serialization boundary, signature failures become hard to reason about. A minimal reproducer that compares the digest over raw bytes vs the digest over the decoded string should make the source of the mismatch obvious quickly.