yarnpkg/yarn · error · SecurityError

Incorrect hash when fetching from the cache for $0. Cache ha

Error message

Incorrect hash when fetching from the cache for $0. Cache has $1 and remote has $2. Run `yarn cache clean` to fix the problem

What it means

Thrown as a `SecurityError` by `fetchCache` when the cached package's hash does not match the remote's declared hash. This is the legacy-hash counterpart to the integrity (SRI) check: if `remote.hash` is set and `cacheHash` is missing or differs, Yarn refuses to use the cached artifact.

Source

Thrown at src/package-fetcher.js:36

  remote: PackageRemote,
): Promise<FetchedMetadata> {
  // $FlowFixMe: This error doesn't make sense
  const {hash, package: pkg, remote: cacheRemote} = await config.readPackageMetadata(dest);

  const cacheIntegrity = cacheRemote.cacheIntegrity || cacheRemote.integrity;
  const cacheHash = cacheRemote.hash;

  if (remote.integrity) {
    if (!cacheIntegrity || !ssri.parse(cacheIntegrity).match(remote.integrity)) {
      throw new SecurityError(
        config.reporter.lang('fetchBadIntegrityCache', pkg.name, cacheIntegrity, remote.integrity),
      );
    }
  }

  if (remote.hash) {
    if (!cacheHash || cacheHash !== remote.hash) {
      throw new SecurityError(config.reporter.lang('fetchBadHashCache', pkg.name, cacheHash, remote.hash));
    }
  }

  await fetcher.setupMirrorFromCache();
  return {
    package: pkg,
    hash,
    dest,
    cached: true,
  };
}

export async function fetchOneRemote(
  remote: PackageRemote,
  name: string,
  version: string,
  dest: string,
  config: Config,

View on GitHub (pinned to c2dda503f3)

Solutions

  1. Run `yarn cache clean` and `yarn install` to re-fetch with a correct hash.
  2. Remove the specific package from the cache directory if you know which one failed.
  3. Verify the registry is serving consistent tarballs (check with `curl` + a hash tool).
  4. If on a private mirror, resync the mirror.

Example fix

# before
yarn install   # throws fetchBadHashCache
# after
yarn cache clean
yarn install
Defensive patterns

Strategy: fallback

Validate before calling

function verifyCacheHash(cacheHash, remoteHash) {
  if (!remoteHash) return true;
  return cacheHash === remoteHash;
}

Try / catch

try {
  return await fetchCache(dest, fetcher, config, remote);
} catch (err) {
  if (err instanceof SecurityError && err.message.includes('hash')) {
    await fs.unlink(dest).catch(() => {});
    return await fetcher.fetch({name, version});
  }
  throw err;
}

Prevention

When it happens

Trigger: The cache entry's hash field does not equal the remote's hash. Occurs when a cache entry is stale/corrupted or when a registry changed the tarball for a version that predates SRI integrity fields.

Common situations: Old cache entries from before integrity migration. Cache corruption. A registry re-published a version. Migrating between registries that compute hashes differently.

Related errors

AI-assisted analysis of yarnpkg/yarn@c2dda503f3 (2026-08-13). Data as JSON: /api/errors/e9223c911b8b036b. Report an issue: GitHub.