mongodb/node-mongodb-native · error · MongoRuntimeError

Invalid server nonce length ${serverNonce.length}, expected

Error message

Invalid server nonce length ${serverNonce.length}, expected 64

What it means

Thrown during MONGODB-AWS SASL exchange when the server's saslStart response nonce ('s' field) is not exactly 64 bytes. The AWS conversation expects the server to echo the 32-byte client nonce plus its own 32 bytes (total 64); a different length indicates a malformed or tampered response.

Source

Thrown at src/cmap/auth/mongodb_aws.ts:82

    // All messages between MongoDB clients and servers are sent as BSON objects
    // in the payload field of saslStart and saslContinue.
    const saslStart = {
      saslStart: 1,
      mechanism: 'MONGODB-AWS',
      payload: BSON.serialize({ r: nonce, p: ASCII_N }, bsonOptions)
    };

    const saslStartResponse = await connection.command(ns(`${db}.$cmd`), saslStart, undefined);

    const serverResponse = BSON.deserialize(saslStartResponse.payload.buffer, bsonOptions) as {
      s: Binary;
      h: string;
    };
    const host = serverResponse.h;
    const serverNonce = serverResponse.s.buffer;
    if (serverNonce.length !== 64) {
      // TODO(NODE-3483)
      throw new MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`);
    }

    if (!ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {
      // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes
      // https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#conversation-5

      // TODO(NODE-3483)
      throw new MongoRuntimeError('Server nonce does not begin with client nonce');
    }

    if (host.length < 1 || host.length > 255 || host.indexOf('..') !== -1) {
      // TODO(NODE-3483)
      throw new MongoRuntimeError(`Server returned an invalid host: "${host}"`);
    }

    const body = 'Action=GetCallerIdentity&Version=2011-06-15';
    const headers = await aws4Sign(
      {

View on GitHub (pinned to dce7939f86)

Solutions

1. Verify you are connecting to a genuine MongoDB server that supports MONGODB-AWS (MongoDB 4.4+).
2. Remove proxies/load-balancers that may alter the BSON payload and retry directly.
3. Upgrade the driver to the latest patch release; if it persists, report with server version and logs.

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoRuntimeError && /server nonce length/.test(e.message)) {
    // likely a non-conformant server; switch endpoint or report
  }
  throw e;
}

When it happens

Trigger: After sending saslStart, the deserialized serverResponse.s.buffer does not have length 64. Fires at mongodb_aws.ts:82. Typically a server-side or wire-level anomaly, not a client config issue.

Common situations: Talking to a non-conformant or buggy MongoDB-compatible server. Man-in-the-middle or proxy mangling the BSON payload. Driver/server version mismatch in the AWS SASL implementation.

Related errors

• Server nonce does not begin with client nonce
• Server returned an invalid host: "${host}"
• ${error.message}
• AuthContext must provide credentials.
• Could not obtain temporary MONGODB-AWS credentials

AI-assisted analysis of mongodb/node-mongodb-native@dce7939f86 (2026-08-11). Data as JSON: /api/errors/e86283780ce8fd18. Report an issue: GitHub.