crypto: fix Argon2 FIPS bypass and KDF error loss by panva · Pull Request #64776 · nodejs/node

panva · 2026-07-27T09:59:23Z

Argon2 ran its KDF in a private OSSL_LIB_CTX, which inherits no configuration, so it
worked in FIPS mode while every other non-approved algorithm was refused. Availability is
now checked against the default context.

The KDF helpers also cleared the OpenSSL error queue on return, leaving Argon2, HKDF,
PBKDF2 and scrypt failures as bare Errors with no code or opensslErrorStack.

The private OSSL_LIB_CTX used for OSSL_set_max_threads() inherits no configuration, so Argon2 escaped FIPS mode and --openssl-config. Check availability against the default context, and create the private one only when lanes > 1. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

The ncrypto KDF helpers cleared the OpenSSL error queue on return, and the traits insert their own message, which makes DeriveBitsJob skip errors->Capture(). Argon2, HKDF, PBKDF2 and scrypt failures were therefore bare Errors with no code and no opensslErrorStack. Drop the guard, which DeriveBitsJob already provides, and capture before inserting since Capture() clears the store. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

nodejs-github-bot · 2026-07-27T09:59:28Z

Review requested:

@nodejs/crypto
@nodejs/security-wg

codecov · 2026-07-27T11:37:14Z

Codecov Report

❌ Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.15%. Comparing base (54a5095) to head (a075357).
⚠️ Report is 99 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_scrypt.cc	0.00%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #64776 +/- ##
=======================================
Coverage 90.14% 90.15% =======================================
Files 744 744 Lines 242518 242522 +4 Branches 45685 45698 +13 =======================================
+ Hits 218611 218634 +23 - Misses 15396 15402 +6 + Partials 8511 8486 -25

Files with missing lines	Coverage Δ
src/crypto/crypto_argon2.cc	`65.38% <100.00%> (+0.33%)`	⬆️
src/crypto/crypto_hkdf.cc	`66.66% <100.00%> (+0.40%)`	⬆️
src/crypto/crypto_pbkdf2.cc	`67.10% <100.00%> (+0.43%)`	⬆️
src/crypto/crypto_scrypt.cc	`72.83% <0.00%> (-0.92%)`	⬇️

... and 37 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-07-28T22:40:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/75273/

bricss · 2026-08-02T10:33:09Z

Any ETA when this PR might land? 🙂

panva · 2026-08-02T10:36:32Z

Any ETA when this PR might land? 🙂

When the time gate for the given number of collaborator approvals passes.

nodejs-github-bot · 2026-08-03T11:44:05Z

Landed in e0e37fe...a937758

The private OSSL_LIB_CTX used for OSSL_set_max_threads() inherits no configuration, so Argon2 escaped FIPS mode and --openssl-config. Check availability against the default context, and create the private one only when lanes > 1. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #64776 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

The ncrypto KDF helpers cleared the OpenSSL error queue on return, and the traits insert their own message, which makes DeriveBitsJob skip errors->Capture(). Argon2, HKDF, PBKDF2 and scrypt failures were therefore bare Errors with no code and no opensslErrorStack. Drop the guard, which DeriveBitsJob already provides, and capture before inserting since Capture() clears the store. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #64776 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>