crypto: make DEP0206 end-of-life - #65141
Closed
mcollina wants to merge 2 commits into
Closed
Conversation
Hmac.prototype._flush was aliased to Hash.prototype._flush, which finalizes the native HMAC context but never sets the JavaScript-side kFinalized flag. After an Hmac has been used as a stream, a subsequent Hmac.prototype.digest() call therefore still believes the object has not been finalized and calls into C++ a second time. On that second call the native context has already been reset, so the digest buffer is never written and Digest::MAX_SIZE bytes of uninitialized stack memory are returned to JavaScript. Hash is not affected because Hash::HashDigest caches its digest (refs nodejs#28245); Hmac never received the equivalent protection. Give Hmac its own _flush that sets kFinalized so repeat digest() calls after stream use are handled by the existing DEP0206 guard. As defense in depth, also set buf.len = 0 on the native side when the context has already been reset so unwritten bytes can never be emitted.
DEP0206 (calling Hmac.digest() more than once) is a runtime deprecation that returns an empty buffer instead of throwing, which is inconsistent with hash.digest() and can mask misuse. Make it end-of-life by throwing ERR_CRYPTO_HASH_FINALIZED on a finalized Hmac instance, matching the behavior of Hash.digest(). This also closes the stream path: with the kFinalized flag now set by Hmac.prototype._flush, digest() after the Hmac has been used as a stream throws instead of reaching the native side and returning uninitialized stack memory. Remove the now-unused DEP0206 warning emitter and the empty-buffer return path, and update the tests to verify the throw on both the direct and stream paths.
Collaborator
|
Review requested:
|
nodejs-github-bot
added
c++
mcollina
added
the
semver-major
panva
requested changes
Aug 8, 2026
Member
Author
|
oh no :( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make DEP0206 (calling
Hmac.digest()more than once) end-of-life.Currently a repeat
digest()on a finalizedHmacreturns an empty buffer with a deprecation warning, which is inconsistent withhash.digest()and can mask misuse. This makes it end-of-life by throwingERR_CRYPTO_HASH_FINALIZEDon a finalizedHmacinstance, matching the behavior ofHash.digest().This also closes the stream path: with the
kFinalizedflag now set byHmac.prototype._flush(see the related fix for uninitialized memory after stream use),digest()after theHmachas been used as a stream throws instead of reaching the native side and returning uninitialized stack memory.Removes the now-unused DEP0206 warning emitter and the empty-buffer return path, updates the tests to verify the throw on both the direct and stream paths, and renames
test-crypto-dep0206.jstotest-crypto-hmac-finalized.jssince the deprecation no longer exists.