{"record":{"id":"b913bdb2a467ba5f","repo":"denoland/deno","slug":"err-out-of-range-b913bd","errorCode":"ERR_OUT_OF_RANGE","errorMessage":"The value of \"iterations\" is out of range. It must be <= ${MAX_I32}. Received ${iterations}","messagePattern":"The value of \"iterations\" is out of range\\. It must be <= (.+?)\\. Received (.+?)","errorType":"exception","errorClass":"NodeRangeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/pbkdf2.ts","lineNumber":61,"sourceCode":"\nconst MAX_ALLOC = MathPow(2, 30) - 1;\nconst MAX_I32 = 2 ** 31 - 1;\n\nfunction check(\n  password: any,\n  salt: any,\n  iterations: number,\n  keylen: number,\n  digest: string,\n) {\n  validateString(digest, \"digest\");\n  password = getArrayBufferOrView(password, \"password\", \"buffer\");\n  salt = getArrayBufferOrView(salt, \"salt\", \"buffer\");\n  validateUint32(iterations, \"iterations\", true);\n  validateUint32(keylen, \"keylen\");\n\n  if (iterations > MAX_I32) {\n    throw new ERR_OUT_OF_RANGE(\"iterations\", `<= ${MAX_I32}`, iterations);\n  }\n\n  if (keylen > MAX_I32) {\n    throw new ERR_OUT_OF_RANGE(\"keylen\", `<= ${MAX_I32}`, keylen);\n  }\n\n  return { password, salt, iterations, keylen, digest };\n}\n\n/**\n * @param iterations Needs to be higher or equal than zero\n * @param keylen  Needs to be higher or equal than zero but less than max allocation size (2^30)\n * @param digest Algorithm to be used for encryption\n */\nfunction pbkdf2Sync(\n  password: any,\n  salt: any,\n  iterations: number,","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/pbkdf2.ts#L43-L79","documentation":"pbkdf2's argument checker (check() in ext/node/polyfills/internal/crypto/pbkdf2.ts) throws ERR_OUT_OF_RANGE when 'iterations' exceeds 2147483647 (2^31-1). iterations is first validated as a positive uint32, then explicitly capped at the signed 32-bit limit used by the native PBKDF2 implementation. Values above it cannot be passed to the underlying crypto library at all.","triggerScenarios":"crypto.pbkdf2Sync(password, salt, 3_000_000_000, 32, 'sha256') — any iterations value greater than MAX_I32, including via the async crypto.pbkdf2 form.","commonSituations":"Security-policy numbers translated with a wrong multiplier (600k read as 600,000,000); iterations parsed from config with a stray unit or extra digit; benchmark scripts cranking iteration counts to extremes.","solutions":["Use a realistic iteration count, e.g., 100,000-600,000 for PBKDF2-SHA256 per current OWASP guidance","Clamp and validate iterations <= 2147483647 before calling pbkdf2","If you genuinely need more key stretching, switch to scrypt or argon2 rather than pushing iterations past the cap"],"exampleFix":"// before\nconst iterations = Number(cfg.iterations); // 3_000_000_000 from config\ncrypto.pbkdf2Sync(pw, salt, iterations, 32, 'sha256'); // throws\n\n// after\nconst iterations = Math.min(Number(cfg.iterations), 600_000);\ncrypto.pbkdf2Sync(pw, salt, iterations, 32, 'sha256');","handlingStrategy":"validation","validationCode":"const MAX_I32 = 2 ** 31 - 1;\nif (!Number.isInteger(iterations) || iterations <= 0 || iterations > MAX_I32) {\n  throw new RangeError(`iterations must be an integer in (0, ${MAX_I32}]`);\n}\ncrypto.pbkdf2Sync(password, salt, iterations, keylen, digest);","typeGuard":"const isValidPbkdf2Iterations = (n: unknown): n is number =>\n  typeof n === 'number' && Number.isInteger(n) && n > 0 && n <= 2 ** 31 - 1;","tryCatchPattern":"try {\n  crypto.pbkdf2Sync(password, salt, iterations, keylen, digest);\n} catch (e) {\n  if (e?.code === 'ERR_OUT_OF_RANGE' && /iterations/.test(e.message)) {\n    throw new Error(`refusing absurd iterations=${iterations}; check config`);\n  } else throw e;\n}","preventionTips":["Parse iterations from config as an integer and bound-check against 2^31-1","Store security-policy iteration counts in code review, not ad-hoc config edits","Prefer scrypt/argon2 when more stretching is genuinely needed"],"tags":["crypto","pbkdf2","parameter-validation","node-compat"],"backgroundTag":"crypto-parameter-out-of-range","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}