denoland/deno · error · Error

FIPS mode is not supported in Deno.

Error message

FIPS mode is not supported in Deno.

What it means

Deno's node:crypto binding implements setFips enabled as an unconditional throw: Deno's bundled crypto stack is not FIPS-validated, so setFipsCrypto(_fips) raises a plain Error ('FIPS mode is not supported in Deno.') while getFipsCrypto() always returns false. This is a deliberate compatibility divergence, not a transient failure.

Source

Thrown at ext/node/polyfills/internal_binding/crypto.ts:17

// Copyright 2018-2026 the Deno authors. MIT license.
// Copyright Joyent, Inc. and Node.js contributors. All rights reserved. MIT license.

(function () {
const { core, primordials } = __bootstrap;
const { timingSafeEqual } = core.loadExtScript(
  "ext:deno_node/internal_binding/_timingSafeEqual.ts",
);

const { Error } = primordials;

function getFipsCrypto(): boolean {
  return false;
}

function setFipsCrypto(_fips: boolean) {
  throw new Error("FIPS mode is not supported in Deno.");
}

return { timingSafeEqual, getFipsCrypto, setFipsCrypto };
})();

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Remove or disable the setFips() call when running under Deno
2. Feature-detect: if (process.versions.deno || !crypto.setFips) skip the FIPS toggle — or check crypto.getFips() === false and treat it as 'FIPS unavailable'
3. If FIPS compliance is mandatory for the workload, run that service on a FIPS-certified Node.js/OpenSSL build instead of Deno

Example fix

// before
require('node:crypto').setFips(true); // throws under Deno

// after
const crypto = require('node:crypto');
if (!process.versions.deno && typeof crypto.setFips === 'function') {
  crypto.setFips(true);
}

const canFips = !process.versions.deno &&
  typeof (crypto as any).setFips === 'function';
if (canFips) crypto.setFips(true);

try {
  crypto.setFips(true);
} catch (e: any) {
  if (/FIPS mode is not supported/.test(e?.message ?? '')) {
    // proceed without FIPS or fail the compliance gate explicitly
  } else throw e;
}

When it happens

Trigger: Calling require('node:crypto').setFips(true); compliance or enterprise startup code that enables FIPS mode when an env var (e.g. NODE_FIPS=1) or policy flag is set; libraries that probe and toggle FIPS at boot.

Common situations: Porting regulated-industry (government, healthcare, finance) Node services that call setFips in CI or production entrypoints; Docker images built for FIPS Node reused for Deno; startup scripts that enable FIPS unconditionally when they detect OpenSSL.

Related errors

• ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED
• ERR_INVALID_ARG_TYPE
• ERR_CRYPTO_FIPS_FORCED
• ERR_INVALID_ARG_TYPE
• ERR_CRYPTO_UNKNOWN_CIPHER

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/e1493c5da451a2dc. Report an issue: GitHub.