{"record":{"id":"e9223c911b8b036b","repo":"yarnpkg/yarn","slug":"incorrect-hash-when-fetching-from-the-cache-for-0","errorCode":null,"errorMessage":"Incorrect hash when fetching from the cache for $0. Cache has $1 and remote has $2. Run `yarn cache clean` to fix the problem","messagePattern":"Incorrect hash when fetching from the cache for \\$0\\. Cache has \\$1 and remote has \\$2\\. Run `yarn cache clean` to fix the problem","errorType":"exception","errorClass":"SecurityError","httpStatus":null,"severity":"error","filePath":"src/package-fetcher.js","lineNumber":36,"sourceCode":"  remote: PackageRemote,\n): Promise<FetchedMetadata> {\n  // $FlowFixMe: This error doesn't make sense\n  const {hash, package: pkg, remote: cacheRemote} = await config.readPackageMetadata(dest);\n\n  const cacheIntegrity = cacheRemote.cacheIntegrity || cacheRemote.integrity;\n  const cacheHash = cacheRemote.hash;\n\n  if (remote.integrity) {\n    if (!cacheIntegrity || !ssri.parse(cacheIntegrity).match(remote.integrity)) {\n      throw new SecurityError(\n        config.reporter.lang('fetchBadIntegrityCache', pkg.name, cacheIntegrity, remote.integrity),\n      );\n    }\n  }\n\n  if (remote.hash) {\n    if (!cacheHash || cacheHash !== remote.hash) {\n      throw new SecurityError(config.reporter.lang('fetchBadHashCache', pkg.name, cacheHash, remote.hash));\n    }\n  }\n\n  await fetcher.setupMirrorFromCache();\n  return {\n    package: pkg,\n    hash,\n    dest,\n    cached: true,\n  };\n}\n\nexport async function fetchOneRemote(\n  remote: PackageRemote,\n  name: string,\n  version: string,\n  dest: string,\n  config: Config,","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/yarnpkg/yarn/blob/c2dda503f3759b5be5f0e24ecd9cf5c97a540147/src/package-fetcher.js#L18-L54","documentation":"Thrown as a `SecurityError` by `fetchCache` when the cached package's hash does not match the remote's declared hash. This is the legacy-hash counterpart to the integrity (SRI) check: if `remote.hash` is set and `cacheHash` is missing or differs, Yarn refuses to use the cached artifact.","triggerScenarios":"The cache entry's hash field does not equal the remote's hash. Occurs when a cache entry is stale/corrupted or when a registry changed the tarball for a version that predates SRI integrity fields.","commonSituations":"Old cache entries from before integrity migration. Cache corruption. A registry re-published a version. Migrating between registries that compute hashes differently.","solutions":["Run `yarn cache clean` and `yarn install` to re-fetch with a correct hash.","Remove the specific package from the cache directory if you know which one failed.","Verify the registry is serving consistent tarballs (check with `curl` + a hash tool).","If on a private mirror, resync the mirror."],"exampleFix":"# before\nyarn install   # throws fetchBadHashCache\n# after\nyarn cache clean\nyarn install","handlingStrategy":"fallback","validationCode":"function verifyCacheHash(cacheHash, remoteHash) {\n  if (!remoteHash) return true;\n  return cacheHash === remoteHash;\n}","typeGuard":null,"tryCatchPattern":"try {\n  return await fetchCache(dest, fetcher, config, remote);\n} catch (err) {\n  if (err instanceof SecurityError && err.message.includes('hash')) {\n    await fs.unlink(dest).catch(() => {});\n    return await fetcher.fetch({name, version});\n  }\n  throw err;\n}","preventionTips":["Run `yarn cache clean` after an interrupted or failed install.","Ensure private registries serve deterministic tarballs (no silent republishing).","Avoid manually editing cache directories."],"tags":["security","cache","hash","install"],"backgroundTag":null,"analyzedSha":"c2dda503f3759b5be5f0e24ecd9cf5c97a540147","analyzedAt":"2026-08-13T04:17:06.305Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}