move from buffer-equal-constant-time to timingSafeEqual

Hi.
Reason of this proposal is described here: Shinobi #452. Please also see note here: Publish deprecation notice #6

This is causing a failed build on my production project due to multiple libraries depending on jsonwebtoken or jws, that ultimately depend on this library.

Would prefer a NodeJS dependency free solution that dose not depend on node:crypto or node:buffer in the hope of one day being better cross compatible with other env. and instead operates on Uint8Array

So i would just rather inline the solution and build a more generic solution that works on any typed array.

function timingEq(a, b) {
  if (a.length !== b.length) return false

  let c = 0
  for (let i = 0, len = a.length; i < len; i++) c |= a[i] ^ b[i]
  return !c
}

This package use SlowBuffer.prototype.equal; which will be removed in upcoming Node.js v24

Node.js v24.0.0 was released, and now causing a crash:

node_modules/.pnpm/buffer-equal-constant-time@1.0.1/node_modules/buffer-equal-constant-time/index.js:37
var origSlowBufEqual = SlowBuffer.prototype.equal;
    ...Finishing writing to cache...                                                                                                                                                                                    ^

TypeError: Cannot read properties of undefined (reading 'prototype')
    at Object.<anonymous> (node_modules/.pnpm/buffer-equal-constant-time@1.0.1/node_modules/buffer-equal-constant-time/index.js:
37:35)
    at Module._compile (node:internal/modules/cjs/loader:1734:14)
    at Object..js (node:internal/modules/cjs/loader:1899:10)
    at Module.load (node:internal/modules/cjs/loader:1469:32)
    at Module._load (node:internal/modules/cjs/loader:1286:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
    at Module.require (node:internal/modules/cjs/loader:1491:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (node_modules/.pnpm/jwa@2.0.0/node_modules/jwa/index.js:1:19)

Node.js v24.0.0

Same issue, today it broke with the new Node.

We've released patched versions of the jwa module. These releases take care of not using the deprecated code when crypto.timingSafeEqual() is available (while still using it when run in legacy codebase with EOL Node.js versions where it wasn't available).

Running npm upgrade jwa (or whichever package manager alternative you happen to use) will pick those patched versions up and fix the issue for you.

I will leave this issue open to hopefully avoid new issues from being open and will comment again when a Node.js release with the deprecated (but not removed) functionality is available.

Edit: Node.js v24.0.1 was released on 2025-05-08 which reverts the problematic removal, it will still be removed in v25.x in October, but with the release of jwa@1.4.2 and jwa@2.0.1 these APIs are no longer in use so long as you upgrade your dependency tree, e.g. via npm upgrade jwa.

Update deps, specifically jwa

Node v25 rc.1 fails because of that. Is there any plan to migrate to timingSafeEqual soon?

@kirrg001

@kirrg001 jwa@1.4.2 and jwa@2.0.1 do use timingSafeEqual when available in the runtime. You just have to update your dependency tree.

build: bumped jwa sub dependency

build: bumped jwa sub dependency (#2065)

Support nodejs 25 by bumping jwa.

Closed by #52

Navigation Menu

Repository navigation

move from `buffer-equal-constant-time` to `timingSafeEqual` #46

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

move from buffer-equal-constant-time to timingSafeEqual #46

Description

Activity

thaisfaria commented on Mar 30, 2023

jimmywarting commented on Aug 25, 2023

shrujalshah28 commented on May 2, 2025

theoludwig commented on May 6, 2025

dasbts commented on May 6, 2025

panva commented on May 7, 2025

kirrg001 commented on Oct 13, 2025

panva commented on Oct 13, 2025

mbtools commented on Dec 12, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

move from `buffer-equal-constant-time` to `timingSafeEqual` #46