move from `buffer-equal-constant-time` to `timingSafeEqual`

[niziak]

Hi.
Reason of this proposal is described here: Shinobi #452. Please also see note here: Publish deprecation notice #6

[thaisfaria]

This is causing a failed build on my production project due to multiple libraries depending on jsonwebtoken or jws, that ultimately depend on this library.

[jimmywarting]

Would prefer a NodeJS dependency free solution that dose not depend on node:crypto or node:buffer in the hope of one day being better cross compatible with other env. and instead operates on Uint8Array

So i would just rather inline the solution and build a more generic solution that works on any typed array.

function timingEq(a, b) {
  if (a.length !== b.length) return false

  let c = 0
  for (let i = 0, len = a.length; i < len; i++) c |= a[i] ^ b[i]
  return !c
}

[shrujalshah28]

This package use SlowBuffer.prototype.equal; which will be removed in upcoming Node.js v24

[theoludwig]

Node.js v24.0.0 was released, and now causing a crash:

node_modules/.pnpm/buffer-equal-constant-time@1.0.1/node_modules/buffer-equal-constant-time/index.js:37
var origSlowBufEqual = SlowBuffer.prototype.equal;
    ...Finishing writing to cache...                                                                                                                                                                                    ^

TypeError: Cannot read properties of undefined (reading 'prototype')
    at Object.<anonymous> (node_modules/.pnpm/buffer-equal-constant-time@1.0.1/node_modules/buffer-equal-constant-time/index.js:
37:35)
    at Module._compile (node:internal/modules/cjs/loader:1734:14)
    at Object..js (node:internal/modules/cjs/loader:1899:10)
    at Module.load (node:internal/modules/cjs/loader:1469:32)
    at Module._load (node:internal/modules/cjs/loader:1286:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
    at Module.require (node:internal/modules/cjs/loader:1491:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (node_modules/.pnpm/jwa@2.0.0/node_modules/jwa/index.js:1:19)

Node.js v24.0.0

[dasbts]

Same issue, today it broke with the new Node.

[panva]

We've released patched versions of the jwa module. These releases take care of not using the deprecated code when crypto.timingSafeEqual() is available (while still using it when run in legacy codebase with EOL Node.js versions where it wasn't available).

Running npm upgrade jwa (or whichever package manager alternative you happen to use) will pick those patched versions up and fix the issue for you.

I will leave this issue open to hopefully avoid new issues from being open and will comment again when a Node.js release with the deprecated (but not removed) functionality is available.

Edit: Node.js v24.0.1 was released on 2025-05-08 which reverts the problematic removal, it will still be removed in v25.x in October, but with the release of jwa@1.4.2 and jwa@2.0.1 these APIs are no longer in use so long as you upgrade your dependency tree, e.g. via npm upgrade jwa.

[kirrg001]

Node v25 rc.1 fails because of that. Is there any plan to migrate to timingSafeEqual soon?

[panva]

@kirrg001 jwa@1.4.2 and jwa@2.0.1 do use timingSafeEqual when available in the runtime. You just have to update your dependency tree.