mongodb/node-mongodb-native · error · MongoRuntimeError

Server returned an invalid iteration count ${iterations}

Error message

Server returned an invalid iteration count ${iterations}

What it means

Thrown by continueScramConversation() (scram.ts:147) as a MongoRuntimeError when the server's SCRAM response contains an iteration count 'i' that is positive but below 4096. RFC 5802 and MongoDB's security policy require a minimum of 4096 PBKDF2 iterations; a lower value is either a misconfigured or compromised server, so the driver refuses to proceed.

Source

Thrown at src/cmap/auth/scram.ts:147

  const nonce = authContext.nonce;

  const db = credentials.source;
  const username = cleanUsername(credentials.username);
  const password = credentials.password;

  const processedPassword =
    cryptoMethod === 'sha256' ? saslprep(password) : passwordDigest(username, password);

  const payload: Binary = ByteUtils.isUint8Array(response.payload)
    ? new Binary(response.payload)
    : response.payload;

  const dict = parsePayload(payload);

  const iterations = parseInt(dict.i, 10);
  if (iterations && iterations < 4096) {
    // TODO(NODE-3483)
    throw new MongoRuntimeError(`Server returned an invalid iteration count ${iterations}`);
  }

  const salt = dict.s;
  const rnonce = dict.r;
  if (rnonce.startsWith('nonce')) {
    // TODO(NODE-3483)
    throw new MongoRuntimeError(`Server returned an invalid nonce: ${rnonce}`);
  }

  // Set up start of proof
  const withoutProof = `c=biws,r=${rnonce}`;
  const saltedPassword = await HI(
    processedPassword,
    ByteUtils.fromBase64(salt),
    iterations,
    cryptoMethod
  );

View on GitHub (pinned to 3366c21a63)

Solutions

1. Upgrade the target server to a version that enforces >= 4096 iterations
2. If using a MongoDB-compatible proxy/mock, fix its SCRAM response to use >= 4096 iterations
3. Verify network path integrity - a downgrade here can indicate tampering
4. Switch to SCRAM-SHA-256 which the server typically configures with stronger parameters

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoRuntimeError && /iteration count/i.test(e.message)) {
    // server is misconfigured or non-genuine; upgrade or switch target
  }
  throw e;
}

When it happens

Trigger: Server returns a SCRAM payload whose 'i' field parses to a number between 1 and 4095; the server was explicitly configured with a weak iteration count; a man-in-the-middle downgrade attack; a buggy/mock server.

Common situations: Connecting to an old or custom MongoDB-compatible server (e.g. some early Cosmos DB / DocumentDB / FerretDB versions) that advertised low iteration counts; test fixtures with hand-crafted SCRAM responses.

Related errors

• Server returned an invalid nonce: ${rnonce}
• Server returned an invalid signature
• Password cannot be empty
• Username required for mechanism '${this.mechanism}'
• Server nonce does not begin with client nonce

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/b6ed4345bbd14938.json. Report an issue: GitHub.