{"record":{"id":"a6d995fb15916676","repo":"auth0/node-jsonwebtoken","slug":"secretorprivatekey-has-a-minimum-key-size-of-2048","errorCode":null,"errorMessage":"secretOrPrivateKey has a minimum key size of 2048 bits for ${header.alg}","messagePattern":"secretOrPrivateKey has a minimum key size of 2048 bits for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sign.js","lineNumber":249,"sourceCode":"\n    jws.createSign({\n      header: header,\n      privateKey: secretOrPrivateKey,\n      payload: payload,\n      encoding: encoding\n    }).once('error', callback)\n      .once('done', function (signature) {\n        // TODO: Remove in favor of the modulus length check before signing once node 15+ is the minimum supported version\n        if(!options.allowInsecureKeySizes && /^(?:RS|PS)/.test(header.alg) && signature.length < 256) {\n          return callback(new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${header.alg}`))\n        }\n        callback(null, signature);\n      });\n  } else {\n    let signature = jws.sign({header: header, payload: payload, secret: secretOrPrivateKey, encoding: encoding});\n    // TODO: Remove in favor of the modulus length check before signing once node 15+ is the minimum supported version\n    if(!options.allowInsecureKeySizes && /^(?:RS|PS)/.test(header.alg) && signature.length < 256) {\n      throw new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${header.alg}`)\n    }\n    return signature\n  }\n};\n","sourceCodeStart":231,"sourceCodeEnd":254,"githubUrl":"https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/sign.js#L231-L254","documentation":"For RS/PS algorithms, jwt.sign() performs a post-signature length check: an RSA signature shorter than 256 bytes implies a modulus smaller than 2048 bits, which the library rejects as insecure. This protects against weak keys; it can be bypassed with the allowInsecureKeySizes option (or is unnecessary on Node 15+, which enforces key size at crypto level).","triggerScenarios":"jwt.sign(payload, smallRsaKeyPem, { algorithm: 'RS256' }) with a 1024-bit (or smaller) RSA key; verification-side equivalents where the private key used was generated with -b 1024.","commonSituations":"Old RSA keys generated years ago at 1024 bits; test fixtures with tiny keys; OpenSSL defaults changed over versions so legacy automation still emits 1024-bit keys; copying sample keys from old tutorials.","solutions":["Generate a new RSA key of at least 2048 bits: openssl genrsa -out key.pem 2048 (4096 preferred)","Set options.allowInsecureKeySizes: true only for legacy/testing, never in production","On Node 15+, rely on native enforcement — upgrade the key regardless, since Node will also reject short keys","Rotate the key pair and update all verifiers with the new public key"],"exampleFix":"// before\nopenssl genrsa -out key.pem 1024\njwt.sign(payload, key, { algorithm: 'RS256' });\n// after\nopenssl genrsa -out key.pem 2048\njwt.sign(payload, key, { algorithm: 'RS256' });","handlingStrategy":"validation","validationCode":"const { createPublicKey } = require('crypto');\nfunction rsaKeyBitsOk(pem) {\n  const key = createPublicKey(pem);\n  const bits = key.asymmetricKeyDetails?.modulusLength;\n  return bits === undefined || bits >= 2048;\n}\nif (!rsaKeyBitsOk(privateKey)) throw new Error('RSA key must be >= 2048 bits');","typeGuard":"function hasSufficientRsaModulus(keyObj) {\n  const bits = keyObj?.asymmetricKeyDetails?.modulusLength;\n  return bits === undefined || bits >= 2048;\n}","tryCatchPattern":"try {\n  return jwt.sign(payload, key, { algorithm: 'RS256' });\n} catch (err) {\n  if (/minimum key size of 2048/.test(err.message)) {\n    throw new Error('Refusing to sign with weak RSA key; regenerate at 2048+ bits');\n  }\n  throw err;\n}","preventionTips":["Generate all RSA keys at 2048+ bits and enforce it in key-rotation tooling","Audit legacy key stores for modulusLength < 2048 and rotate them","Never set allowInsecureKeySizes in production configuration","Fail CI/startup key checks on small moduli rather than at first sign attempt"],"tags":["jwt","weak-key","key-size","security"],"backgroundTag":"jwt-rsa-key-too-small","analyzedSha":"b924272f29192e12926b5414546f7c5bfcc9579d","analyzedAt":"2026-09-02T21:29:06.876Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}