{"record":{"id":"0c13973db3229f19","repo":"denoland/deno","slug":"failed-to-allocate-evp-cipher-ctx","errorCode":null,"errorMessage":"Failed to allocate EVP_CIPHER_CTX","messagePattern":"Failed to allocate EVP_CIPHER_CTX","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"ext/node_crypto/cipher.rs","lineNumber":978,"sourceCode":"        }\n        ChaCha20(Box::new(ChaCha20Cipher::new(key, iv)))\n      }\n      \"chacha20-poly1305\" => {\n        if key.len() != 32 {\n          return Err(CipherError::InvalidKeyLength);\n        }\n        if iv.len() != 12 {\n          return Err(CipherError::InvalidInitializationVector);\n        }\n        let tag_len = auth_tag_length.unwrap_or(16);\n        if !is_valid_chacha20_poly1305_tag_length(tag_len) {\n          return Err(CipherError::InvalidAuthTag(tag_len));\n        }\n        ChaCha20Poly1305(Box::new(\n          ChaCha20Poly1305Cipher::new(key, iv, tag_len, true).map_err(|e| {\n            match e {\n              CipherInitError::ContextAllocation => {\n                panic!(\"Failed to allocate EVP_CIPHER_CTX\")\n              }\n              CipherInitError::InitFailed => CipherError::InvalidKeyLength,\n            }\n          })?,\n        ))\n      }\n      _ => return Err(CipherError::UnknownCipher(algorithm_name.to_string())),\n    })\n  }\n\n  fn set_aad(&mut self, aad: &[u8]) {\n    use Cipher::*;\n    match self {\n      Aes128Gcm(cipher, _) => {\n        cipher.set_aad(aad);\n      }\n      Aes256Gcm(cipher, _) => {\n        cipher.set_aad(aad);","sourceCodeStart":960,"sourceCodeEnd":996,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node_crypto/cipher.rs#L960-L996","documentation":"When node:crypto creates a ChaCha20-Poly1305 cipher via createCipheriv, Deno allocates an OpenSSL EVP_CIPHER_CTX. If that allocation fails (malloc returns null), init reports ContextAllocation and Deno panics — effectively an out-of-memory abort, not a crypto-usage error. Bad key/IV/tag inputs return normal CipherErrors; only the context allocation failure panics.","triggerScenarios":"`crypto.createCipheriv(\"chacha20-poly1305\" | \"id-chacha20-poly1305-ietf\", key, iv)` succeeding validation but failing at EVP_CIPHER_CTX_new because the process is out of memory.","commonSituations":"Containers with low memory limits doing bulk encryption; workloads creating a cipher per chunk in a hot loop without calling final(); leaks elsewhere in the process crowding out the OpenSSL allocator.","solutions":["Relieve memory pressure: raise container/cgroup limits or restart the leaking process","Create one cipher per message (update then final), not per chunk, so contexts are released","Check for leaked Cipher objects — a missing final() keeps contexts alive","If memory looks healthy, update Deno — a runtime regression would affect everyone using the cipher"],"exampleFix":"// before — new cipher context per chunk\nfor (const chunk of chunks) {\n  const c = crypto.createCipheriv(\"chacha20-poly1305\", key, iv);\n  out.push(c.update(chunk), c.final());\n}\n\n// after — one cipher per message; final() frees the context\nconst c = crypto.createCipheriv(\"chacha20-poly1305\", key, iv);\nfor (const chunk of chunks) out.push(c.update(chunk));\nout.push(c.final());","handlingStrategy":"fallback","validationCode":"// pre-flight: refuse to create ciphers under memory pressure\nconst { rss } = Deno.memoryUsage();\nconst total = Deno.systemMemoryInfo()?.total ?? Infinity;\nif (rss > 0.85 * total) {\n  throw new Error(\"memory pressure: defer creating new cipher contexts\");\n}\nconst c = crypto.createCipheriv(\"chacha20-poly1305\", key, iv);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Create one cipher per message and always call final() so contexts are freed","Avoid createCipheriv inside tight per-chunk loops","Raise container memory limits above the encryption workload's peak","Watch for leaked Cipher/Decipher objects that never finalize"],"tags":["node-crypto","openssl","chacha20-poly1305","allocation","out-of-memory"],"backgroundTag":"openssl-context-allocation-failed","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}