brianc/node-postgres · error · TypeError

SASL: attribute pairs text must be a string

Error message

SASL: attribute pairs text must be a string

What it means

A TypeError thrown by parseAttributePairs() when the input text is not a string. This function splits a SASL message into a Map of attribute key-value pairs and is called from parseServerFirstMessage() and parseServerFinalMessage(). Both callers receive data that was already string-validated upstream (continueSession at lines 72-73, finalizeSession at lines 133-134), making this a redundant belt-and-suspenders guard.

Source

Thrown at packages/pg/lib/crypto/sasl.js:177

/**
 * base64-char     = ALPHA / DIGIT / "/" / "+"
 *
 * base64-4        = 4base64-char
 *
 * base64-3        = 3base64-char "="
 *
 * base64-2        = 2base64-char "=="
 *
 * base64          = *base64-4 [base64-3 / base64-2]
 */
function isBase64(text) {
  return /^(?:[a-zA-Z0-9+/]{4})*(?:[a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=)?$/.test(text)
}

function parseAttributePairs(text) {
  if (typeof text !== 'string') {
    throw new TypeError('SASL: attribute pairs text must be a string')
  }

  return new Map(
    text.split(',').map((attrValue) => {
      if (!/^.=/.test(attrValue)) {
        throw new Error('SASL: Invalid attribute pair entry')
      }
      const name = attrValue[0]
      const value = attrValue.substring(2)
      return [name, value]
    })
  )
}

function parseServerFirstMessage(data) {
  const attrPairs = parseAttributePairs(data)

  const nonce = attrPairs.get('r')

View on GitHub (pinned to ff9d775abd)

Solutions

1. Reinstall node-postgres — this is an internal defensive guard not reachable in production.
2. Audit custom SASL handling code that might call internal functions directly.

// Unreachable in normal operation — wrap connect() as a general safety net
try { await client.connect() } catch (e) { /* log and surface connection error */ }

When it happens

Trigger: parseAttributePairs() is called from parseServerFirstMessage (line 193) or parseServerFinalMessage (line 223). Both call sites are preceded by a typeof check that would throw a different error first (errors [20] and the SCRAM-SERVER-FIRST-MESSAGE serverData check). So this guard only fires if parseAttributePairs is called directly with a non-string, bypassing the upstream checks.

Common situations: Unreachable through normal pg connection flow. Would require a custom fork or a direct call to the internal parseAttributePairs function with a non-string argument.

Related errors

• SASL: text must be a string
• SASL: SCRAM-SERVER-FINAL-MESSAGE: serverData must be a strin
• Buffers cannot be empty
• SASL: SCRAM-SERVER-FINAL-MESSAGE: server signature does not
• SASL: Invalid attribute pair entry

AI-assisted analysis of brianc/node-postgres@ff9d775abd (2026-08-11). Data as JSON: /api/errors/ae367b69027f6cc1. Report an issue: GitHub.