{"record":{"id":"e86283780ce8fd18","repo":"mongodb/node-mongodb-native","slug":"invalid-server-nonce-length-servernonce-length","errorCode":null,"errorMessage":"Invalid server nonce length ${serverNonce.length}, expected 64","messagePattern":"Invalid server nonce length (.+?), expected 64","errorType":"exception","errorClass":"MongoRuntimeError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_aws.ts","lineNumber":82,"sourceCode":"    // All messages between MongoDB clients and servers are sent as BSON objects\n    // in the payload field of saslStart and saslContinue.\n    const saslStart = {\n      saslStart: 1,\n      mechanism: 'MONGODB-AWS',\n      payload: BSON.serialize({ r: nonce, p: ASCII_N }, bsonOptions)\n    };\n\n    const saslStartResponse = await connection.command(ns(`${db}.$cmd`), saslStart, undefined);\n\n    const serverResponse = BSON.deserialize(saslStartResponse.payload.buffer, bsonOptions) as {\n      s: Binary;\n      h: string;\n    };\n    const host = serverResponse.h;\n    const serverNonce = serverResponse.s.buffer;\n    if (serverNonce.length !== 64) {\n      // TODO(NODE-3483)\n      throw new MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`);\n    }\n\n    if (!ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {\n      // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes\n      // https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#conversation-5\n\n      // TODO(NODE-3483)\n      throw new MongoRuntimeError('Server nonce does not begin with client nonce');\n    }\n\n    if (host.length < 1 || host.length > 255 || host.indexOf('..') !== -1) {\n      // TODO(NODE-3483)\n      throw new MongoRuntimeError(`Server returned an invalid host: \"${host}\"`);\n    }\n\n    const body = 'Action=GetCallerIdentity&Version=2011-06-15';\n    const headers = await aws4Sign(\n      {","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/dce7939f86fb283e167ad709955abedb7bf23124/src/cmap/auth/mongodb_aws.ts#L64-L100","documentation":"Thrown during MONGODB-AWS SASL exchange when the server's saslStart response nonce ('s' field) is not exactly 64 bytes. The AWS conversation expects the server to echo the 32-byte client nonce plus its own 32 bytes (total 64); a different length indicates a malformed or tampered response.","triggerScenarios":"After sending saslStart, the deserialized serverResponse.s.buffer does not have length 64. Fires at mongodb_aws.ts:82. Typically a server-side or wire-level anomaly, not a client config issue.","commonSituations":"Talking to a non-conformant or buggy MongoDB-compatible server. Man-in-the-middle or proxy mangling the BSON payload. Driver/server version mismatch in the AWS SASL implementation.","solutions":["Verify you are connecting to a genuine MongoDB server that supports MONGODB-AWS (MongoDB 4.4+).","Remove proxies/load-balancers that may alter the BSON payload and retry directly.","Upgrade the driver to the latest patch release; if it persists, report with server version and logs."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoRuntimeError && /server nonce length/.test(e.message)) {\n    // likely a non-conformant server; switch endpoint or report\n  }\n  throw e;\n}","preventionTips":["Connect only to genuine MongoDB 4.4+ servers for MONGODB-AWS.","Avoid intercepting proxies that rewrite BSON payloads.","Keep the driver updated to the latest patch."],"tags":["authentication","aws","wire-protocol","runtime"],"backgroundTag":null,"analyzedSha":"dce7939f86fb283e167ad709955abedb7bf23124","analyzedAt":"2026-08-11T04:54:53.215Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}