Disable FIPS for NodeJS build

Question

I am running into the following problem when building NodeJS app on a FIPS-enabled RHEL8 server. The command is CI=false npm run build

Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS
at new Hash (node:internal/crypto/hash:69:19)
at createHash (node:crypto:136:10)

Same application builds fine on another FIPS-enabled RHEL8 server.

Here is the set up on the server where I get the error:

• OS Version: Red Hat Enterprise Linux release 8.10 (Ootpa)
• OpenSSL Version: OpenSSL 1.1.1k FIPS 25 Mar 2021
• Node Version: v18.20.4
• Running fips-mode-setup --check gives "FIPS mode is enabled"
• Running node -p 'crypto.getFips()' gives "1".

And here is the set up on the server where it builds fine:

• OS Version: Red Hat Enterprise Linux release 8.10 (Ootpa)
• OpenSSL Version: OpenSSL 1.1.1k FIPS 25 Mar 2021
• Node Version: v18.20.3
• Running fips-mode-setup --check gives "FIPS mode is enabled"
• Running node -p 'crypto.getFips()' gives "0".

It looks like the server where I get the error has FIPS enabled on both the OS and NodeJS levels. And the server where it builds fine also has FIPS enabled on the OS level but NodeJS FIPS is disabled.

My question is how can I disable FIPS on the NodeJS level and keep FIPS enabled on the OS level? I can't change FIPS on the OS level but I have control over NodeJS installation. And I am not sure how Node was installed in the server where the build runs fine. I have no control over that.

I tried running node -p 'crypto.setFips(0)' but I am getting the following error: Error \[ERR_CRYPTO_FIPS_SYSTEM_CONTROLLED\]: Cannot set FIPS mode. FIPS should be enabled/disabled at system level.

Thank you.

Answer 1

I ran into a similar issue on a RHEL 8 server and a create-react-app project using react-scripts@5.0.1, although your particular issue might be different depending on the caller of createHash. It turns out that the MD5 hashing algorithm is not supported by a FIPS environment, per the answer here. In my case, the react-scripts@5.0.1 module was the culprit. The quick fix was to replace 'md5' with 'sha256' in node_modules/react-scripts/config/webpack/persistentCache/createEnvironmentHash.js. The sed command works for this:

sed -i -e 's/md5/sha256/g' node_modules/react-scripts/config/webpack/persistentCache/createEnvironmentHash.js

A more ideal long-term solution would be to move away from the legacy create-react-app solution to a more modern solution like Vite. I haven't taken the time to do so myself, but a migration guide is available here.

Of course, your solution will be different if react-scripts is not the culprit.