denoland/deno · error · Error

ERR_CRYPTO_FIPS_FORCED

ERR_CRYPTO_FIPS_FORCED

Error message

Cannot set FIPS mode, it was forced with --force-fips at startup.

What it means

When the runtime starts in forced-FIPS mode, setFips is wired to setFipsForced (see the fipsForced selection at crypto.ts:378-379): enabling FIPS again is a silent no-op, but any attempt to disable it throws ERR_CRYPTO_FIPS_FORCED, because the startup decision must not be relaxed at runtime.

Source

Thrown at ext/node/polyfills/crypto.ts:364

  options?: TransformOptions,
) {
  return Hmac_(hmac, key, options);
}

function createSign(algorithm: string, options?: WritableOptions): Sign {
  return new Sign(algorithm, options);
}

function createVerify(algorithm: string, options?: WritableOptions): Verify {
  return new Verify(algorithm, options);
}

function setFipsForced(val: boolean) {
  if (val) {
    return;
  }

  throw new ERR_CRYPTO_FIPS_FORCED();
}

function getFipsForced() {
  return 1;
}

ObjectDefineProperty(constants, "defaultCipherList", {
  __proto__: null,
  value: getOptionValue("--tls-cipher-list"),
});

const getDiffieHellman = createDiffieHellmanGroup;

const getFips = fipsForced ? getFipsForced : getFipsCrypto;
const setFips = fipsForced ? setFipsForced : setFipsCrypto;

const sign = signOneShot;
const verify = verifyOneShot;

View on GitHub (pinned to 89f33cbef2)

Solutions

Do not call setFips(false) when FIPS is forced — keep it enabled
Gate the call on startup flags: skip when process.execArgv includes '--force-fips'
Check crypto.getFips() first; in forced mode it always returns 1

Example fix

// before
crypto.setFips(false);
// after
if (!process.execArgv.includes("--force-fips")) crypto.setFips(false);

Defensive patterns

Strategy: try-catch

Validate before calling

const fipsForcedAtStartup =
  process.execArgv.includes("--force-fips") || process.env.NODE_FORCE_FIPS === "1";
if (!fipsForcedAtStartup) crypto.setFips(enableFips);

Try / catch

try {
  crypto.setFips(false);
} catch (e) {
  if (e.code === "ERR_CRYPTO_FIPS_FORCED") {
    // FIPS locked at startup — keep it enabled and continue
  } else throw e;
}

Prevention

Never hardcode setFips(false) in shared libraries
Check crypto.getFips() (always 1 when forced) before toggling
Document FIPS requirements in deployment configuration so ops and app code agree

When it happens

Trigger: Starting Deno/Node with --force-fips, then calling crypto.setFips(false); libraries or perf tweaks that toggle setFips(!isProd) unconditionally; code that calls setFips(false) as 'cleanup' after a setFips(true) probe.

Common situations: Compliance-mandated environments where operators force FIPS while application code assumes it can toggle it; shared crypto wrappers managing FIPS from config; CI running with different flags than production.

Related errors

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/9859151ad144f227. Report an issue: GitHub.