Repository navigation
"async" argon2 freezes the main event loop #62861
Description
Original detect from @deepview-autofix:
To validate:
import { argon2, randomBytes } from 'node:crypto'
const parameters = {
message: 'password',
nonce: randomBytes(16),
parallelism: 4,
tagLength: 64,
memory: 65536,
passes: 1000, // the only thing changed from doc to demonstrate
};
console.log(`Start at ${new Date().toISOString()}`)
argon2('argon2id', parameters, () => {})
console.log(`Unblocked at ${new Date().toISOString()}`) // this takes 10 seconds on my Aircc @panva perhaps?
Likely too complex for an autofix.
Also does not qualify to be a security bug, hence public.
Activity
[-]async argon2 freezes the event loop[/-][+]async argon2 freezes the main event loop[/+][-]async argon2 freezes the main event loop[/-][+]"async" argon2 freezes the main event loop[/+]panva commentedon Apr 21, 2026
FYI the API is still in
cc @jasnell @ranisalt
ChALkeR commentedon Apr 21, 2026
Yes, I'm aware, and that's precisely why this is public!
panva commentedon Apr 21, 2026
I'm aware that you're aware :) Just calling it out for clarity.
panva commentedon Apr 21, 2026
@ChALkeR what about the scrypt or PBKDF2 jobs?
ChALkeR commentedon Apr 21, 2026
It had "FYI" so I replied 😄
@panva scrypt is fine:
pbkdf2 is fine too:
compare to argon2:
passes=10 (parameters from doc example):
passes=100:
passes=1000:
It literally is just computed twice: once in sync, once in async, per every async call (at least judging from the numbers)
crypto: remove Argon2 KDF derivation from its job setup
crypto: remove Argon2 KDF derivation from its job setup
crypto: remove Argon2 KDF derivation from its job setup
crypto: remove Argon2 KDF derivation from its job setup
Merge upstream Node.js v24.18.1 into dotnet/main (#375)