Use Case

As a Node.js application developer using the MongoDB driver in a bundled ESM server, I want SCRAM-SHA-1 authentication to work when Node's built-in crypto module is available.

User Experience

• Expected outcome: MongoDB authentication succeeds when the driver is bundled into ESM output and executed in Node.js.
• Actual outcome: SCRAM-SHA-1 authentication fails because a raw require('crypto') call remains in the emitted ESM bundle.
• Impact: the affected application cannot establish its database connection after deployment.

Observed error:

MongoRuntimeError: Node.js crypto module is required for SCRAM-SHA-1 authentication
    at passwordDigest (file:///app/dist/index.js:187333:13)
    at continueScramConversation (file:///app/dist/index.js:187264:96)
    ...
[cause]: ReferenceError: require is not defined
    at passwordDigest (file:///app/dist/index.js:187331:7)

The deployment error also contains HandshakeError and ResetPool labels.

In my application, the driver is used through @shopify/shopify-app-session-storage-mongodb. An isolated reproduction demonstrates the failure without Shopify.

Source

https://github.com/mongodb/node-mongodb-native/blob/v7.7.0/src/cmap/auth/scram.ts#L217-L243

Dependencies

• MongoDB driver: 7.7.0
• Local reproduction runtime: Node.js v22.21.1
• Local reproduction bundler: Vite v7.3.7

Risks/Unknowns

• I have not established which driver version introduced this particular failure.
• Startup-only bundling tests may miss this issue because the failing branch requires SHA-1 authentication.

Acceptance Criteria

Implementation Requirements

• SCRAM-SHA-1 works in bundled ESM Node applications without a global require shim or crypto-specific bundler workaround.

Testing Requirements

• Add a regression test that bundles to ESM and executes SHA-1 password digest / proof generation without a global require.