What causes "Password cannot be empty" in mongodb/node-mongodb-native?

Set a real, non-empty password on the MongoDB user and in the connection string

mongodb/node-mongodb-native · error · MongoInvalidArgumentError

Password cannot be empty

Error message

Password cannot be empty

What it means

Thrown by passwordDigest() (scram.ts:227) as a MongoInvalidArgumentError when the password is an empty string. An empty password is rejected because SCRAM-SHA-1 derives a deterministic, trivially-brute-forced digest from it - a security defect the driver refuses to allow. Distinct from 'wrong password'; this is 'no password at all'.

Source

Thrown at src/cmap/auth/scram.ts:227

  const parts = payloadStr.split(',');
  for (let i = 0; i < parts.length; i++) {
    const valueParts = (parts[i].match(/^([^=]*)=(.*)$/) ?? []).slice(1);
    dict[valueParts[0]] = valueParts[1];
  }
  return dict;
}

function passwordDigest(username: string, password: string) {
  if (typeof username !== 'string') {
    throw new MongoInvalidArgumentError('Username must be a string');
  }

  if (typeof password !== 'string') {
    throw new MongoInvalidArgumentError('Password must be a string');
  }

  if (password.length === 0) {
    throw new MongoInvalidArgumentError('Password cannot be empty');
  }

  let nodeCrypto;
  try {
    // TODO: NODE-7424 - remove dependency on 'crypto' for SCRAM-SHA-1 authentication
    // eslint-disable-next-line @typescript-eslint/no-require-imports
    nodeCrypto = require('crypto');
  } catch (e) {
    throw new MongoRuntimeError(
      'Node.js crypto module is required for SCRAM-SHA-1 authentication',
      {
        cause: e
      }
    );
  }

  try {
    const md5 = nodeCrypto.createHash('md5');

View on GitHub (pinned to 3366c21a63)

Solutions

Set a real, non-empty password on the MongoDB user and in the connection string
Verify the password env var is actually set and non-empty before constructing the client
If loading from a secret store, fail fast when the secret value is empty rather than passing ''

Example fix

// before
const client = new MongoClient('mongodb://user:@host'); // empty password
// after
const client = new MongoClient(`mongodb://user:${encodeURIComponent(process.env.DB_PASS)}@host`);

Defensive patterns

Strategy: validation

Validate before calling

function assertNonEmptyPassword(p: unknown): asserts p is string {
  if (typeof p !== 'string' || p.length === 0) throw new Error('password must be a non-empty string');
}
assertNonEmptyPassword(process.env.DB_PASS);

Type guard

function isNonEmptyPassword(p: unknown): p is string {
  return typeof p === 'string' && p.length > 0;
}

Prevention

Assert password env vars are set and non-empty at app startup
Fail fast when secret stores return empty values
Avoid passing whitespace-trimmed passwords that become empty

When it happens

Trigger: Credentials built with password === '' - e.g. a connection string with an empty password segment ('user:@host') or a credentials resolver that returned an empty string after stripping whitespace.

Common situations: Connection string 'mongodb://user:@host' with empty password; env var DB_PASS unset (empty string default); secret-manager lookup returning '' for a not-yet-provisioned secret; trimming a whitespace-only password to empty.

Related errors

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/ae65f36c4939b8f2.json. Report an issue: GitHub.