{"record":{"id":"e1493c5da451a2dc","repo":"denoland/deno","slug":"fips-mode-is-not-supported-in-deno","errorCode":null,"errorMessage":"FIPS mode is not supported in Deno.","messagePattern":"FIPS mode is not supported in Deno\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal_binding/crypto.ts","lineNumber":17,"sourceCode":"// Copyright 2018-2026 the Deno authors. MIT license.\n// Copyright Joyent, Inc. and Node.js contributors. All rights reserved. MIT license.\n\n(function () {\nconst { core, primordials } = __bootstrap;\nconst { timingSafeEqual } = core.loadExtScript(\n  \"ext:deno_node/internal_binding/_timingSafeEqual.ts\",\n);\n\nconst { Error } = primordials;\n\nfunction getFipsCrypto(): boolean {\n  return false;\n}\n\nfunction setFipsCrypto(_fips: boolean) {\n  throw new Error(\"FIPS mode is not supported in Deno.\");\n}\n\nreturn { timingSafeEqual, getFipsCrypto, setFipsCrypto };\n})();\n","sourceCodeStart":1,"sourceCodeEnd":22,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal_binding/crypto.ts#L1-L22","documentation":"Deno's node:crypto binding implements setFips enabled as an unconditional throw: Deno's bundled crypto stack is not FIPS-validated, so setFipsCrypto(_fips) raises a plain Error ('FIPS mode is not supported in Deno.') while getFipsCrypto() always returns false. This is a deliberate compatibility divergence, not a transient failure.","triggerScenarios":"Calling require('node:crypto').setFips(true); compliance or enterprise startup code that enables FIPS mode when an env var (e.g. NODE_FIPS=1) or policy flag is set; libraries that probe and toggle FIPS at boot.","commonSituations":"Porting regulated-industry (government, healthcare, finance) Node services that call setFips in CI or production entrypoints; Docker images built for FIPS Node reused for Deno; startup scripts that enable FIPS unconditionally when they detect OpenSSL.","solutions":["Remove or disable the setFips() call when running under Deno","Feature-detect: if (process.versions.deno || !crypto.setFips) skip the FIPS toggle — or check crypto.getFips() === false and treat it as 'FIPS unavailable'","If FIPS compliance is mandatory for the workload, run that service on a FIPS-certified Node.js/OpenSSL build instead of Deno"],"exampleFix":"// before\nrequire('node:crypto').setFips(true); // throws under Deno\n\n// after\nconst crypto = require('node:crypto');\nif (!process.versions.deno && typeof crypto.setFips === 'function') {\n  crypto.setFips(true);\n}","handlingStrategy":"try-catch","validationCode":"const canFips = !process.versions.deno &&\n  typeof (crypto as any).setFips === 'function';\nif (canFips) crypto.setFips(true);","typeGuard":null,"tryCatchPattern":"try {\n  crypto.setFips(true);\n} catch (e: any) {\n  if (/FIPS mode is not supported/.test(e?.message ?? '')) {\n    // proceed without FIPS or fail the compliance gate explicitly\n  } else throw e;\n}","preventionTips":["Gate FIPS toggling on runtime detection (process.versions.deno / crypto.getFips())","Make compliance a deployment property (certified runtime image), not an application call","Document the divergence when porting FIPS-mode Node services to Deno"],"tags":["crypto","fips","compliance","node-compat"],"backgroundTag":"fips-mode-unsupported","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}