René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"crypto.Hash.write swallows errors","articleBody":"### Version\n\nv25.9.0\n\n### Platform\n\n```text\nLinux 749dbb0e74fd 6.8.0-106-generic #106-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar  6 07:58:08 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux\n```\n\n### Subsystem\n\ncrypto\n\n### What steps will reproduce the bug?\n\nI'm working on a software-fault-injection testing library that injected a fault into the crypto bindings. Specifically a fault here: https://github.com/nodejs/node/blob/a2aeb72bff19c89fe742f5a2db8cfc8d6407f830/deps/ncrypto/ncrypto.cc#L4326\nTo reproduce this issue, change that code to always return false for simplicity; indicating a failed crypto hash update action.\n\nThen execute the following JavaScript code:\n```js\nconst crypto = require('crypto');\n\nconst h = crypto.createHash('sha3-512');\nh.write('hello');\n//h.update('hello'); This line throws\nh.end();\n```\n\nIf we were to use the update call, then it throws an exception.\nHowever, the above code uses the write call. The write call returns true (which makes sense as the return value doesn't indicate success/failure). But I don't see an indication of an error: no exception, no error event emitted. It _seems_ that the error is silently swallowed.\n\nI did try using a callback for the write call:\n```js\nconst crypto = require('crypto');\n\nconst h = crypto.createHash('sha3-512');\nh.write('hello', console.log);\nh.end();\n```\n\nand this just logs `null`. Also no indication of an error.\n\n### How often does it reproduce? Is there a required condition?\n\nConsistently reproduces if false is returned from here:\n\nhttps://github.com/nodejs/node/blob/a2aeb72bff19c89fe742f5a2db8cfc8d6407f830/deps/ncrypto/ncrypto.cc#L4326\n\n### What is the expected behavior? Why is that the expected behavior?\n\nI had expected an exception, a false return value, or an error event emitted somewhere but none of these things seem to happen.\nI could be wrong though about my expectations and missing something.\n\n### What do you see instead?\n\nThe code runs to completion, and if checking the digest, it produces the same digest as if there was no data written to the Hash stream. This means that errors are silently swallowed and the wrong hash is produced.\n\n### Additional information\n\nThis issue was found using a hybrid static-dynamic analyzer I'm working on.","author":{"url":"https://github.com/ndossche","@type":"Person","name":"ndossche"},"datePublished":"2026-05-11T21:18:55.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/63258/node/issues/63258"}