{"id":"f578c0ca7f4dded4","repo":"mongodb/node-mongodb-native","slug":"node-js-crypto-module-is-required-for-scram-sha-1","errorCode":null,"errorMessage":"Node.js crypto module is required for SCRAM-SHA-1 authentication","messagePattern":"Node\\.js crypto module is required for SCRAM-SHA-1 authentication","errorType":"exception","errorClass":"MongoRuntimeError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/scram.ts","lineNumber":236,"sourceCode":"  if (typeof username !== 'string') {\n    throw new MongoInvalidArgumentError('Username must be a string');\n  }\n\n  if (typeof password !== 'string') {\n    throw new MongoInvalidArgumentError('Password must be a string');\n  }\n\n  if (password.length === 0) {\n    throw new MongoInvalidArgumentError('Password cannot be empty');\n  }\n\n  let nodeCrypto;\n  try {\n    // TODO: NODE-7424 - remove dependency on 'crypto' for SCRAM-SHA-1 authentication\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    nodeCrypto = require('crypto');\n  } catch (e) {\n    throw new MongoRuntimeError(\n      'Node.js crypto module is required for SCRAM-SHA-1 authentication',\n      {\n        cause: e\n      }\n    );\n  }\n\n  try {\n    const md5 = nodeCrypto.createHash('md5');\n    md5.update(`${username}:mongo:${password}`, 'utf8');\n    return md5.digest('hex');\n  } catch (err) {\n    if (nodeCrypto.getFips()) {\n      // This error is (slightly) more helpful than what comes from OpenSSL directly, e.g.\n      // 'Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS'\n      throw new Error('Auth mechanism SCRAM-SHA-1 is not supported in FIPS mode');\n    }\n    throw err;","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/scram.ts#L218-L254","documentation":"Thrown by passwordDigest() (scram.ts:236) as a MongoRuntimeError when require('crypto') throws, meaning the Node.js crypto module is unavailable. SCRAM-SHA-1 authentication needs crypto to compute the MD5 password digest. In standard Node this is always present; the error indicates a stripped/custom runtime or sandboxing that removed built-in modules.","triggerScenarios":"Running in a constrained environment where the 'crypto' built-in has been removed or disabled (some edge runtimes, sandboxed eval, or bundler configs that externalize built-ins incorrectly). The require('crypto') call itself throws.","commonSituations":"Bundlers (webpack/esbuild) misconfigured to treat 'crypto' as external in a non-Node environment; running the driver in a non-Node runtime that lacks crypto; security policy stripping built-ins.","solutions":["Run in a standard Node.js runtime where 'crypto' is a built-in","Fix bundler config: set target: 'node' and do not mark 'crypto' as external in browser builds","Switch to SCRAM-SHA-256 which uses WebCrypto (crypto.subtle) instead of the crypto module for the digest step where possible","If sandboxing, allowlist the 'crypto' built-in module"],"exampleFix":"// webpack.config.js - before\ntarget: 'web',\n// after\ntarget: 'node',","handlingStrategy":"type-guard","validationCode":"function hasCryptoModule(): boolean {\n  try { require('crypto'); return true; } catch { return false; }\n}\nif (!hasCryptoModule()) throw new Error('Node.js crypto module unavailable; cannot use SCRAM-SHA-1');","typeGuard":"declare const crypto: typeof import('crypto') | undefined;\nfunction hasNodeCrypto(): crypto is typeof import('crypto') {\n  try { require('crypto'); return true; } catch { return false; }\n}","tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoRuntimeError && /crypto module is required/i.test(e.message)) {\n    // fix runtime/bundler, or switch authMechanism to SCRAM-SHA-256\n  }\n  throw e;\n}","preventionTips":["Set bundler target to 'node' so 'crypto' resolves to the built-in","Do not externalize Node built-ins in browser-targeted builds of the driver","Prefer SCRAM-SHA-256 which uses WebCrypto where possible"],"tags":["auth","scram","crypto","runtime","bundling"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}