Repository navigation
Node 24.4.0 OOMs with pnpm #59057
Description
Activity
I'd noticed this as well. Bisects to #58121, likely related to the changes to
Hash::OneShotDigest. The offending call is here.Without testing, I'm fairly certain that the culprit will end up being
node/src/crypto/crypto_hash.cc
Line 278 in 4dafa77
This currently tries to create a Utf8Value from the source data, but before checking whether or not the data is a string, which leads to an attempt to stringify the entire binary. Previously, this initialisation only took place where the input was typechecked.
cc: @nodejs/crypto
- added 3 commits that reference this issue
on Jul 14, 2025 - added a commit that references this issue
on Jul 15, 2025 - added a commit that references this issue
on Jul 16, 2025 Windows here, also encountered this
@Aditi-1400 ... Fyi... I'll take a look this weekend but if you'd like to investigate too, please do :-)
Reacted by Aditi@Renegade334 ... Excellent work narrowing this down.
@jasnell #59067 seems to fix this :) Thanks @Renegade334!
- added a commit that references this issue
on Jul 18, 2025 - added a commit that references this issue
on Jul 21, 2025 - marked [REGRESSION] JavaScript heap out of memory with nodejs 24.4.1 when building Heroic Games Launcher #59175 as a duplicate of this issue
on Jul 23, 2025 Worth getting a CVE since it affects trivial uses of
createHash?- added a commit that references this issue
on Aug 14, 2025 - added 2 commits that reference this issue
on Aug 29, 2025
Version
24.4.0
Platform
Subsystem
No response
What steps will reproduce the bug?
See pnpm/pnpm#9743
It appears that something as simply as
pnpm install --save @iconify/jsonusing the latest pnpm and node are showing the issue.Downgrading to Node 24.3 fixes the issue.
How often does it reproduce? Is there a required condition?
All the time.
What is the expected behavior? Why is that the expected behavior?
Not to OOM.
What do you see instead?
OOMs.
Additional information
No response