Two major things here:
1. AES-CBC needs to be used with an unpredictable IV, which will need to be carried along with the ciphertext.
2. You should sign first, then encrypt (payload + signature).  See, e.g., http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.html

```
var plaintext = Buffer.concat([payload, hmac]);
// ...
var iv = crypto.randomBytes(16);
cipher = crypto.createCipheriv(this.cipherAlgorithm, this.encryptionSecret, iv);
cipher.write(plaintext);
// ...
return base64.encode(Buffer.concat([iv,encipheredPayload])); // see comment about sign-then-encrypt
```
If you don't want to take the size hit, you could make a smaller IV (say half-size) and pad with zeros.