Latest v22 version caused hash update function to behave unusually

[PavelSarlov]

Version

v22.20.0

Platform

Linux 5.15.0-156-generic #166-Ubuntu SMP Sat Aug 9 00:02:46 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Microsoft Windows NT 10.0.22631.0 x64

Subsystem

crypto

What steps will reproduce the bug?

Reproducible with the following code (adjust accordingly if filename is different):

const { createHash } = require("crypto");
const { createReadStream } = require("fs");

async function hashFile(path) {
  const fileStream = createReadStream(path);
  const hash = createHash("md5");

  fileStream.pipe(hash).on("data", (data) => {
    hash.update(data);
  });

  return new Promise((resolve, reject) => {
    fileStream.on("error", (err) => reject(err));
    fileStream.on("end", () => resolve(hash.digest("hex")));
  });
}

hashFile("./test.js").then((result) => console.log(result));

How often does it reproduce? Is there a required condition?

Consistently reproducible.

What is the expected behavior? Why is that the expected behavior?

There shouldn't be an error occurring.

What do you see instead?

The following error occurs:

node:events:497
      throw er; // Unhandled 'error' event
      ^

Error [ERR_CRYPTO_HASH_UPDATE_FAILED]: Hash update failed
    at Hash.update (node:internal/crypto/hash:145:11)
    at Hash.<anonymous> (/test.js:9:10)
    at Hash.emit (node:events:519:28)
    at addChunk (node:internal/streams/readable:561:12)
    at readableAddChunkPushByteMode (node:internal/streams/readable:512:3)
    at Readable.push (node:internal/streams/readable:392:5)
    at Hash._flush (node:internal/crypto/hash:128:8)
    at Hash.final [as _final] (node:internal/streams/transform:128:10)
    at prefinish (node:internal/streams/writable:916:14)
    at finishMaybe (node:internal/streams/writable:930:5)
Emitted 'error' event on Hash instance at:
    at Hash.onerror (node:internal/streams/readable:1028:14)
    at Hash.emit (node:events:519:28)
    at emitErrorNT (node:internal/streams/destroy:170:8)
    at emitErrorCloseNT (node:internal/streams/destroy:129:3)
    at process.processTicksAndRejections (node:internal/process/task_queues:90:21) {
  code: 'ERR_CRYPTO_HASH_UPDATE_FAILED'
}

Additional information

It seems catching and ignoring the error is a workaround since the hash produced does match.

[richardlau]

Nothing obviously stands out in the list of things in Node.js 22.20.0, cc @nodejs/crypto

[richardlau]

Above test fails on 24.8.0 and current main.
git bisect on v22.x-staging points to the OpenSSL 3.5.1 update.
cc @nodejs/crypto

[ChALkeR]

Just noting that this part of the test does a strange thing:

  fileStream.pipe(hash).on("data", (data) => {
    hash.update(data);
  });

[bottachai]

We faced same issue on node 22, this code solve it:

`import fs from 'fs';
import crypto from 'crypto';
import { finished } from 'stream/promises';

export const hashLocalFile = async (
filePath: string,
algorithm = 'md5',
): Promise => {
const hasher = crypto.createHash(algorithm);
try {
const streamData = fs.createReadStream(filePath);

streamData.pipe(hasher);
await finished(streamData);

return hasher.digest('hex');

} catch (err: any) {
throw new Error(Can't hash the file at path ${filePath}: ${err.message});
}
};
`

It seems that .pipe(hasher) automatically calls hasher.update() internally so you on need to call hasher.update(data)