René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Runtime-deprecate calling digest() on HMAC more than once","articleBody":"(Upd: detected by the scanner behind @deepview-autofix)\n\nHash behavior is reasonable:\n```js\n\u003e hash = require('crypto').createHash('sha256').update('data')\n\u003e hash.digest()\n\u003cBuffer 3a 6e b0 79 0f 39 ac 87 c9 4f 38 56 b2 dd 2c 5d 11 0e 68 11 60 22 61 a9 a9 23 d3 bb 23 ad c8 b7\u003e\n\u003e hash.digest()\nUncaught Error [ERR_CRYPTO_HASH_FINALIZED]: Digest already called\n    at Hash.digest (node:internal/crypto/hash:155:11) {\n  code: 'ERR_CRYPTO_HASH_FINALIZED'\n}\n```\n\nBut HMAC, on the other hand, returns empty buffers on further `.digest()` calls, likely for compat reasons:\n```js\n\u003e hmac = require('crypto').createHmac('sha256', 'key').update('data')\n\u003e hmac.digest()\n\u003cBuffer 50 31 fe 3d 98 9c 6d 15 37 a0 13 fa 6e 73 9d a2 34 63 fd ae c3 b7 01 37 d8 28 e3 6a ce 22 1b d0\u003e\n\u003e hmac.digest()\n\u003cBuffer \u003e\n```\n\nThis is a footgun with potential security risks, and should be first runtime-deprecated, then removed if no breakage is detected.\n\n---\n\n\u003cimg width=\"1170\" height=\"155\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/5b0e40bc-95ed-49b8-b696-299176bcc01d\" /\u003e","author":{"url":"https://github.com/ChALkeR","@type":"Person","name":"ChALkeR"},"datePublished":"2026-04-20T05:05:11.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":11},"url":"https://github.com/62838/node/issues/62838"}