Repository navigation
Crash in dependencies using SlowBuffer in v24.0.0 #58203
Description
Version
v24.0.0
Platform
Linux a3399d7de011 5.15.167.4-microsoft-standard-WSL2 #1 SMP Tue Nov 5 00:21:55 UTC 2024 x86_64 Linux
Subsystem
No response
What steps will reproduce the bug?
- Use the node:alpine Docker image (which now uses Node.js v24.0.0).
- Install a package (e.g. jsonwebtoken) that depends on buffer-equal-constant-time@1.0.1.
- Run the Node.js app in docker.
How often does it reproduce? Is there a required condition?
every time.
sample repo
What is the expected behavior? Why is that the expected behavior?
The app should not crash. In earlier Node.js versions (e.g. v23, node:lts-alpine), there is no error.
What do you see instead?
/usr/src/app/node_modules/buffer-equal-constant-time/index.js:37
var origSlowBufEqual = SlowBuffer.prototype.equal;
^
TypeError: Cannot read properties of undefined (reading 'prototype')
at Object.<anonymous> (/usr/src/app/node_modules/buffer-equal-constant-time/index.js:37:35)
at Module._compile (node:internal/modules/cjs/loader:1734:14)
at Object..js (node:internal/modules/cjs/loader:1899:10)
at Module.load (node:internal/modules/cjs/loader:1469:32)
at Module._load (node:internal/modules/cjs/loader:1286:12)
at TracingChannel.traceSync (node:diagnostics_channel:322:14)
at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
at Module.require (node:internal/modules/cjs/loader:1491:12)
at require (node:internal/modules/helpers:135:16)
at Object.<anonymous> (/usr/src/app/node_modules/jwa/index.js:1:19)
Node.js v24.0.0
Activity
[-]Crash in dependencies using SlowBuffer in v24[/-][+]Crash in dependencies using SlowBuffer in v24.0.0[/+]jasnell commentedon May 7, 2025
SlowBufferwas removed as it has reached it's end-of-life after being deprecated for quite a number of years ... #58008 ... that is, it no longer exists. You'll want to migrate things to useBuffer.allocUnsafeSlow(n)panva commentedon May 7, 2025
Both runtime-deprecation and EOL happened in the same major, that shouldn't have happened. #58211
jasnell commentedon May 7, 2025
Ugh... You're correct. The SlowBuffer EOL commit was supposed to have been there for 25. Since it landed well after the semver-major cutoff for 24 I think the assumption was that it wouldn't get picked up in 24 but then 24 ended up a bit delayed and it looks like it was. Ok, well, I think a revert specifically for the 24.x release line would be the correct action. Keeping it EOl in main, however, is best.
panva commentedon May 7, 2025
@jasnell agreed, I propose to re-land it on main right after #58211 (it is infact already ready to go)
panva commentedon May 9, 2025
This was resolved with the release of https://github.com/nodejs/node/releases/tag/v24.0.1
The removal will still happen for 25.x and to avoid breakage then (and deprecation warnings now) the jwa module has releases that avoid use of the deprecated, to be removed, functionality.