louislam/uptime-kuma · warning · Error

Invalid new password

Error message

Invalid new password

What it means

Thrown by the 'changePassword' socket handler when password.newPassword is falsy (missing, empty string, or null). This is the first guard, before the password-strength check and before doubleCheckPassword verifies the current password. The callback returns {ok:false, msg:'Invalid new password'}.

Source

Thrown at server/server.js:1451

                callback({
                    ok: true,
                    data: list,
                });
            } catch (e) {
                callback({
                    ok: false,
                    msg: e.message,
                });
            }
        });

        socket.on("changePassword", async (password, callback) => {
            try {
                checkLogin(socket);

                if (!password.newPassword) {
                    throw new Error("Invalid new password");
                }

                if (passwordStrength(password.newPassword).value === "Too weak") {
                    throw new TranslatableError("passwordTooWeak");
                }

                let user = await doubleCheckPassword(socket, password.currentPassword);
                await user.resetPassword(password.newPassword);

                server.disconnectAllSocketClients(user.id, socket.id);

                callback({
                    ok: true,
                    token: User.createJWT(user, server.jwtSecret),
                    msg: "successAuthChangePassword",
                    msgi18n: true,
                });
            } catch (e) {

View on GitHub (pinned to 6b5ea01557)

Solutions

1. Ensure the changePassword payload includes a non-empty newPassword string.
2. Disable the submit button until both current and new password fields are filled.
3. Validate newPassword is a non-empty string before emitting.
4. On {ok:false} with this message, focus the new-password input for the user.

Example fix

// before
socket.emit('changePassword', { currentPassword, newPassword: '' }, cb);

// after
if (!newPassword) return toast.error('Enter a new password');
socket.emit('changePassword', { currentPassword, newPassword }, cb);

// Require a non-empty newPassword before emitting changePassword
if (typeof password?.newPassword !== 'string' || password.newPassword.length === 0) {
  return setError('Enter a new password.');
}
socket.emit('changePassword', password, cb);

function hasNewPassword(pw) {
  return pw != null && typeof pw.newPassword === 'string' && pw.newPassword.length > 0;
}

When it happens

Trigger: A client emits 'changePassword' with an object whose newPassword field is empty/missing, or submits the form without entering a new password.

Common situations: Form submitted with the new-password field empty; the payload object built with the wrong key; refactor that renamed the field; client passing newPassword as undefined.

Related errors

• Invalid period.
• Incorrect current password
• The token is invalid due to password change or old token
• passwordTooWeak
• Uptime Kuma has been initialized. If you want to run setup a

AI-assisted analysis of louislam/uptime-kuma@6b5ea01557 (2026-08-12). Data as JSON: /api/errors/769a6f84a0690c03. Report an issue: GitHub.