fix(NODE-7548): SCRAM authentication fails on non-Node runtimes by PavelSafronov · Pull Request #4932 · mongodb/node-mongodb-native

PavelSafronov · 2026-04-30T21:56:04Z

Description

Summary of Changes

This fixes the deno-specific issue where SCRAM is broken. The bug happens because we are invoking toString implicitly, and this results in a behavior change. The fix is to convert the bytes to string explicitly.

Part of the reason that this was not caught in testing is because we were still targeting node when creating the bundle.

Switching bundler to web exposed a few issues:

removed last few Buffer.readInt32LE calls
skipped more tests in nodeless where sinon can cause test failures
supply globals that are not available in web (TextDecoder, TextEncoder, atob, btoa)
export the created sandbox so our tests can verify that we aren't exporting things like Buffer
update tests that verify error types
update the bundle barrow file with missing exports

Notes for Reviewers

What is the motivation for this change?

Customer-created ticket. Driver is broken infor deno.

Release Highlight

Fixed SCRAM authentication for non-Node.js runtimes (e.g., Deno)

SCRAM-based authentication (the default mechanism for username/password connections) was broken when using the driver in non-Node.js environments such as Deno. The root cause was an implicit toString() call on byte arrays that produced incorrect output outside of Node.js. This fix ensures explicit UTF-8 string conversion is used throughout the SCRAM implementation, restoring authentication in Deno and other web-compatible runtimes.

Double check the following

Lint is passing (npm run check:lint)
Self-review completed using the steps outlined here
PR title follows the correct format: type(NODE-xxxx)[!]: description
- Example: feat(NODE-1234)!: rewriting everything in coffeescript
Changes are covered by tests
New TODOs have a related JIRA ticket

… call also updated bundling logic to correctly remove Buffer. 9 tests are currently failing, with failures that are not related to scram. Co-authored-by: Copilot <copilot@github.com>

Co-authored-by: Copilot <copilot@github.com>

Copilot

Pull request overview

This PR addresses SCRAM authentication and unit test failures when running the driver in “nodeless” (non-Node) runtimes by replacing Node-specific Buffer APIs with runtime-neutral utilities, adjusting the bundling configuration, and conditionally adapting/skipping tests that rely on Node-only behavior.

Changes:

Update SCRAM message parsing/encoding to use ByteUtils UTF-8 helpers instead of Binary#toString('utf8').
Adjust unit tests to run in nodeless environments (conditional assertions, avoiding Buffer APIs, skipping sinon-dependent tests).
Change the driver bundling setup to platform: 'browser' and tighten the VM sandbox globals used by bundled tests.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
test/unit/utils.test.ts	Makes `compareObjectId` tests conditional for nodeless behavior differences.
test/unit/sessions.test.ts	Avoids `instanceof Long` checks in nodeless by using `ensureTypeByName`.
test/unit/nodeless.test.ts	Adds assertions about the VM sandbox not exposing Node globals.
test/unit/commands.test.ts	Replaces Buffer read methods with runtime-neutral helpers.
test/unit/cmap/wire_protocol/on_demand/document.test.ts	Adapts throw assertions for nodeless runtime differences (needs tightening to avoid false positives).
test/unit/cmap/connect.test.ts	Skips sinon-based socket tests when running nodeless.
test/unit/cmap/commands.test.ts	Removes Buffer-specific `toString` usage for document sequence name assertions.
test/unit/client-side-encryption/state_machine.test.ts	Skips sinon-based tests for nodeless runs.
test/tools/runner/vm_context_helper.ts	Updates VM sandbox globals and adds bundle debugging hooks; exports `sandbox`.
test/mongodb_bundled.ts	Exposes additional exports needed by bundled/nodeless tests (`makeSocket`, keep-alive constant).
src/cmap/auth/scram.ts	Switches SCRAM auth message decoding/parsing to `ByteUtils.toUTF8`.
src/bson.ts	Adds `readUint8` helper alongside existing buffer read helpers (needs bounds validation).
etc/bundle-driver.mjs	Bundles with `platform: 'browser'`/`chrome112` and bundles `bson` instead of externalizing it.

Comments suppressed due to low confidence (1)

src/cmap/auth/scram.ts:213

parsePayload currently decodes payload.buffer using payload.buffer.length, which can include unwritten bytes (see Binary.position). It also assumes payload is always a Binary, but other code already handles response.payload being a Uint8Array—r.payload may be as well. Consider normalizing inside parsePayload (accept Binary | Uint8Array) and decode only the actual payload length.

function parsePayload(payload: Binary) {
  const payloadStr = ByteUtils.toUTF8(payload.buffer, 0, payload.buffer.length, true);
  const dict: Document = {};
  const parts = payloadStr.split(',');
  for (let i = 0; i < parts.length; i++) {
    const valueParts = (parts[i].match(/^([^=]*)=(.*)$/) ?? []).slice(1);
    dict[valueParts[0]] = valueParts[1];
  }

- use Binary.position instead of buffer.length - add a validateBufferInputs call to readUint8 - add expect.fail in cases where we expect an exception

tadjik1

thanks @PavelSafronov! I left few small questions, please let me know what you think.
Can you also please take a look at lint errors?

And I guess you spotted another bug by switching the environment:

[2026/05/06 01:26:35.258]   34) Unified test format runner (valid-pass)
[2026/05/06 01:26:35.258]        poc-sessions
[2026/05/06 01:26:35.258]          Server supports implicit sessions:
[2026/05/06 01:26:35.258]      TypeError: [last.command.lsid.id](http://last.command.lsid.id/).buffer.equals is not a function
[2026/05/06 01:26:35.258]       at assertSameLsidOnLastTwoCommands (test/tools/unified-spec-runner/operations.ts:147:38)
[2026/05/06 01:26:35.258]       at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1037:20)
[2026/05/06 01:26:35.258]       at runUnifiedTest (test/tools/unified-spec-runner/runner.ts:239:39)
[2026/05/06 01:26:35.258]       at processTicksAndRejections (node:internal/process/task_queues:104:5)
[2026/05/06 01:26:35.258]       at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:349:13)[2026/05/06 01:26:35.258]   34) Unified test format runner (valid-pass)
[2026/05/06 01:26:35.258]        poc-sessions
[2026/05/06 01:26:35.258]          Server supports implicit sessions:
[2026/05/06 01:26:35.258]      TypeError: [last.command.lsid.id](http://last.command.lsid.id/).buffer.equals is not a function
[2026/05/06 01:26:35.258]       at assertSameLsidOnLastTwoCommands (test/tools/unified-spec-runner/operations.ts:147:38)
[2026/05/06 01:26:35.258]       at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1037:20)
[2026/05/06 01:26:35.258]       at runUnifiedTest (test/tools/unified-spec-runner/runner.ts:239:39)
[2026/05/06 01:26:35.258]       at processTicksAndRejections (node:internal/process/task_queues:104:5)
[2026/05/06 01:26:35.258]       at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:349:13)[2026/05/06 01:26:35.258]   34) Unified test format runner (valid-pass)
[2026/05/06 01:26:35.258]        poc-sessions
[2026/05/06 01:26:35.258]          Server supports implicit sessions:
[2026/05/06 01:26:35.258]      TypeError: [last.command.lsid.id](http://last.command.lsid.id/).buffer.equals is not a function
[2026/05/06 01:26:35.258]       at assertSameLsidOnLastTwoCommands (test/tools/unified-spec-runner/operations.ts:147:38)
[2026/05/06 01:26:35.258]       at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1037:20)
[2026/05/06 01:26:35.258]       at runUnifiedTest (test/tools/unified-spec-runner/runner.ts:239:39)
[2026/05/06 01:26:35.258]       at processTicksAndRejections (node:internal/process/task_queues:104:5)
[2026/05/06 01:26:35.258]       at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:349:13)

TypeError: last.command.lsid.id.buffer.equals is not a function

- lint fixes - use payload.position - add comments about NODE-7576

tadjik1

thanks @PavelSafronov, great work! I have left, I believe, 2 last small comments, to preserve existing behaviour and small typo fix. Everything else is looking really good 👍

- avoid throwing by toUTF8 - clarify comments

tadjik1

LGTM

will merge on complete CI run

nbbeeken

Anna's comments echo my questions I had during review ^^

- remove unnecessary changes

…ked to ticket to fix that behavior in js-bson

PavelSafronov and others added 5 commits April 29, 2026 14:56

fix issue with scram that impacts deno, by avoiding implicit toString…

f678190

… call also updated bundling logic to correctly remove Buffer. 9 tests are currently failing, with failures that are not related to scram. Co-authored-by: Copilot <copilot@github.com>

remove two more toString calls, replace with ByteUtils.toUTF8 calls

cc1dea2

fix bundled unit tests

b1d102a

Co-authored-by: Copilot <copilot@github.com>

add test to check for Node properties on non-node sandbox

ced412f

lint

d0e7fdf

PavelSafronov marked this pull request as ready for review May 5, 2026 22:24

PavelSafronov requested a review from a team as a code owner May 5, 2026 22:24

Copilot AI review requested due to automatic review settings May 5, 2026 22:24

Copilot started reviewing on behalf of PavelSafronov May 5, 2026 22:25 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

PavelSafronov marked this pull request as draft May 5, 2026 22:31

PavelSafronov marked this pull request as ready for review May 5, 2026 22:42

PavelSafronov added 3 commits May 5, 2026 15:49

remove debug code, add comments

c202e61

remove debug statement

fce3dce

pr feedback:

eeef194

- use Binary.position instead of buffer.length - add a validateBufferInputs call to readUint8 - add expect.fail in cases where we expect an exception

tadjik1 self-assigned this May 6, 2026

tadjik1 added the Primary Review In Review with primary reviewer, not yet ready for team's eyes label May 6, 2026

tadjik1 reviewed May 6, 2026

View reviewed changes

Comment thread src/cmap/auth/scram.ts Outdated

tadjik1 reviewed May 6, 2026

View reviewed changes

Comment thread test/unit/utils.test.ts

tadjik1 requested changes May 6, 2026

View reviewed changes

PavelSafronov and others added 10 commits May 6, 2026 09:05

pr feedback:

ddf8f3f

- lint fixes - use payload.position - add comments about NODE-7576

Merge branch 'main' into node-7548-scram-deno

00e8b36

fix broken nodeless tests

4ae5259

lint fixes

ddf9c51

explicit string conversion in tests

9ef574a

lint

4e62eca

skip some node-only tests

7979bd1

add a missing type to bundler

a58ba8d

tests without metadata now inherit parent metadata

e1825c0

skip another node test

6193546

pass string to UUID constructor, so it doesn't throw on a bundled type

0b72911

tadjik1 reviewed May 8, 2026

View reviewed changes

Comment thread src/cmap/auth/scram.ts Outdated

tadjik1 reviewed May 8, 2026

View reviewed changes

Comment thread test/tools/utils.ts Outdated

tadjik1 requested changes May 8, 2026

View reviewed changes

pr feedback:

49dfe25

- avoid throwing by toUTF8 - clarify comments

tadjik1 previously approved these changes May 8, 2026

View reviewed changes

addaleax reviewed May 11, 2026

View reviewed changes

Comment thread src/cmap/auth/scram.ts

Comment thread test/integration/client-side-encryption/driver.test.ts

Comment thread test/tools/runner/vm_context_helper.ts Outdated

nbbeeken reviewed May 11, 2026

View reviewed changes

pr feedback:

c9b90e5

- remove unnecessary changes

PavelSafronov dismissed tadjik1’s stale review via c9b90e5 May 11, 2026 15:00

pr feedback: added a comment about why we're calling toHexString, lin…

b7234d1

…ked to ticket to fix that behavior in js-bson

addaleax approved these changes May 13, 2026

View reviewed changes

tadjik1 approved these changes May 18, 2026

View reviewed changes

nbbeeken approved these changes May 18, 2026

View reviewed changes

Merge branch 'main' into node-7548-scram-deno

9c5f8ef

tadjik1 merged commit a10d2c9 into main May 19, 2026
32 checks passed

tadjik1 deleted the node-7548-scram-deno branch May 19, 2026 06:57

github-actions Bot mentioned this pull request May 19, 2026

chore(main): release 7.2.1 #4944

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(NODE-7548): SCRAM authentication fails on non-Node runtimes#4932

fix(NODE-7548): SCRAM authentication fails on non-Node runtimes#4932
tadjik1 merged 23 commits into
mainfrom
node-7548-scram-deno

PavelSafronov commented Apr 30, 2026 •

edited by tadjik1

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tadjik1 left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

tadjik1 left a comment

Uh oh!

tadjik1 left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nbbeeken left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

PavelSafronov commented Apr 30, 2026 • edited by tadjik1 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Summary of Changes

Notes for Reviewers

What is the motivation for this change?

Release Highlight

Fixed SCRAM authentication for non-Node.js runtimes (e.g., Deno)

Double check the following

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tadjik1 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

tadjik1 left a comment

Choose a reason for hiding this comment

Uh oh!

tadjik1 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nbbeeken left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

PavelSafronov commented Apr 30, 2026 •

edited by tadjik1

Loading

tadjik1 left a comment •

edited

Loading

tadjik1 left a comment •

edited

Loading