facebook/flow · error · Error

flow-dot-js wasm requires crypto.getRandomValues

Error message

flow-dot-js wasm requires crypto.getRandomValues

What it means

The flow.js wasm glue needs a source of randomness (WebAssembly heap setup / hash seeding). It first uses globalThis.crypto.getRandomValues, then falls back to require('crypto') trying webcrypto.getRandomValues and randomFillSync; only when all of these are unavailable does it throw. Hitting it means the runtime exposes neither WebCrypto nor Node's crypto module — typically a stripped sandbox runtime or a bundled environment where 'crypto' was shimmed away.

Source

Thrown at src/flow_dot_js_wasm.js:39

var crypto =
  flowDotJsGlobal.crypto != null &&
  typeof flowDotJsGlobal.crypto.getRandomValues === 'function'
    ? flowDotJsGlobal.crypto
    : {
        getRandomValues(array) {
          if (typeof require === 'function') {
            const nodeCrypto = require('crypto');
            if (
              nodeCrypto.webcrypto != null &&
              typeof nodeCrypto.webcrypto.getRandomValues === 'function'
            ) {
              return nodeCrypto.webcrypto.getRandomValues(array);
            }
            if (typeof nodeCrypto.randomFillSync === 'function') {
              return nodeCrypto.randomFillSync(array);
            }
          }
          throw new Error('flow-dot-js wasm requires crypto.getRandomValues');
        },
      };

let flowDotJsWasmModule;
let flowDotJsAlloc;
let flowDotJsFree;
let flowDotJsStringFree;
let flowDotJsCall;
let flowDotJsReady;

function getFlowDotJsGlobal() {
  return flowDotJsGlobal;
}

function getFlowDotJsExports() {
  if (typeof module === 'object' && module.exports != null) {
    return module.exports;
  }

View on GitHub (pinned to d1341dac89)

Solutions

1. Run on a runtime with WebCrypto: any modern browser over HTTPS or Node.js >= 15 (earlier Node versions still work via randomFillSync).
2. Before the module loads, install a polyfill: globalThis.crypto = {getRandomValues: (arr) => arr.fill(...)} backed by a real CSPRNG of the host.
3. In bundlers, alias the 'crypto' import to a real polyfill package (e.g. crypto-browserify) instead of an empty stub.
4. If the environment truly has no CSPRNG, host the wasm call behind a small service instead of running it in-process.

Example fix

// before
// loaded in a sandbox: no globalThis.crypto, no require('crypto') -> throws
const flow = require('./flow_dot_js_wasm.js');

// after
// install a polyfill backed by the host's CSPRNG first
const nodeCrypto = require('crypto');
globalThis.crypto = nodeCrypto.webcrypto;
const flow = require('./flow_dot_js_wasm.js');

function hasSecureRandom() {
  if (globalThis.crypto?.getRandomValues != null) return true;
  try {
    const c = require('crypto');
    return c?.webcrypto?.getRandomValues != null || c?.randomFillSync != null;
  } catch {
    return false;
  }
}

if (!hasSecureRandom()) {
  throw new Error('This environment cannot run flow.js wasm: no crypto.getRandomValues');
}

let flow;
try {
  flow = require('./flow_dot_js_wasm.js');
} catch (err) {
  if (err.message === 'flow-dot-js wasm requires crypto.getRandomValues') {
    // polyfill with the host CSPRNG, then retry the load once
    globalThis.crypto = require('crypto').webcrypto;
    flow = require('./flow_dot_js_wasm.js');
  } else {
    throw err;
  }
}

When it happens

Trigger: Loading flow_dot_js_wasm.js in a runtime without WebCrypto and without a working require('crypto') (QuickJS/duktape-style sandboxes, some edge/lambda-like isolation layers); bundling for a browser where a bundler stubs the node 'crypto' import to an empty module while the page also lacks globalThis.crypto; extremely old Node builds predating both webcrypto and randomFillSync.

Common situations: Webpack/browserify builds where require('crypto') resolves to an empty shim; executing the module inside restricted CI sandboxes that whitelist modules; older embedded JS engines; Electron/main processes with patched globals.

Related errors

• flow.js wasm export ${name} is unavailable
• flow.js wasm is still loading; await flow.ready first.
• Unexpected function parameter ${param.type}
• updatePendingStatements: Variable for dependency "${dep}" no
• updatePendingStatements: Variable parent of "${dep}" not fou

AI-assisted analysis of facebook/flow@d1341dac89 (2026-08-17). Data as JSON: /api/errors/1519bfe614605ebe. Report an issue: GitHub.