[0.9.7] Crypto no longer working in nginx

[ap-wtioit]

Describe the bug

A clear and concise description of what the bug is.
Before submitting a bug report, please check the following:

• The bug is reproducible with the latest version of njs.
• I minimized the code and NGINX configuration to the smallest
  possible to reproduce the issue.

To reproduce

Steps to reproduce the behavior:

• JS script

import cr from "crypto";

• NGINX configuration if applicable

load_module modules/ngx_http_js_module.so;
http {
    js_import     /etc/nginx/includes/njs/my_script.js;
}

• NGINX logs (when running nginx -t)

nginx: [emerg] ReferenceError: Cannot load module "crypto" (ENOENT:No such file or directory)
nginx: configuration file /etc/nginx/nginx.conf test failed

Expected behavior

Module crypto should be usable in the nginx-module-njs

Your environment

• Version of njs or specific commit 1.30.0+0.9.7-1~bookworm
• Version of NGINX if applicable 1.30.0-1~bookworm
• OS: Debian Bookworm (also happens on our Ubuntu 22.04 tests)

Additional context

docker compose run --rm nginx -V

nginx version: nginx/1.30.0
built by gcc 12.2.0 (Debian 12.2.0-14+deb12u1) 
built with OpenSSL 3.0.18 30 Sep 2025 (running with OpenSSL 3.0.19 27 Jan 2026)
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/run/nginx.pid --lock-path=/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_v3_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-g -O2 -ffile-prefix-map=/home/builder/debuild/nginx-1.30.0/debian/debuild-base/nginx-1.30.0=. -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie'

docker compose run --rm nginx ldd /usr/lib/nginx/modules/ngx_http_js_module.so

	linux-vdso.so.1 (0x00007ffec04f3000)
	libxml2.so.2 => /lib/x86_64-linux-gnu/libxml2.so.2 (0x00007e8332a28000)
	libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007e8332948000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007e8332766000)
	libicuuc.so.72 => /lib/x86_64-linux-gnu/libicuuc.so.72 (0x00007e8332568000)
	libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007e8332549000)
	liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007e8332518000)
	/lib64/ld-linux-x86-64.so.2 (0x00007e8332df3000)
	libicudata.so.72 => /lib/x86_64-linux-gnu/libicudata.so.72 (0x00007e8330746000)
	libstdc++.so.6 => /lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007e833052c000)
	libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007e833050c000)

seems to be missing the openssl libcrypto that shows for the njs binary
docker compose run --rm nginx bash -c 'ldd $(which njs)'

	linux-vdso.so.1 (0x00007ffc4ada3000)
	libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007d5ce05d4000)
	libpcre2-8.so.0 => /lib/x86_64-linux-gnu/libpcre2-8.so.0 (0x00007d5ce053a000)
	libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007d5ce00b2000)
	libxml2.so.2 => /lib/x86_64-linux-gnu/libxml2.so.2 (0x00007d5cdff06000)
	libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007d5cdfee7000)
	libedit.so.2 => /lib/x86_64-linux-gnu/libedit.so.2 (0x00007d5cdfeab000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007d5cdfcc9000)
	/lib64/ld-linux-x86-64.so.2 (0x00007d5ce089f000)
	libicuuc.so.72 => /lib/x86_64-linux-gnu/libicuuc.so.72 (0x00007d5cdfacb000)
	liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007d5cdfa9c000)
	libtinfo.so.6 => /lib/x86_64-linux-gnu/libtinfo.so.6 (0x00007d5cdfa69000)
	libbsd.so.0 => /lib/x86_64-linux-gnu/libbsd.so.0 (0x00007d5cdfa51000)
	libicudata.so.72 => /lib/x86_64-linux-gnu/libicudata.so.72 (0x00007d5cddc7f000)
	libstdc++.so.6 => /lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007d5cdda65000)
	libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007d5cdda45000)
	libmd.so.0 => /lib/x86_64-linux-gnu/libmd.so.0 (0x00007d5cdda38000)

not sure if this is it. but in the njs binary i can load the crypto module:
docker compose run --rm nginx njs

interactive njs (njs:0.9.7)

>> import cr from "crypto";
undefined
>> cr
crypto {
 createHash: [Function: createHash],
 createHmac: [Function: createHmac]
}
>> 

[kaiwu]

I had the issue earlier in the day too, and then realized that 0.9.7 has breaking changes regarding to the crypto module. The doc is updated, so I steered the fixes around the new APIs.

[ap-wtioit]

@kaiwu how do you access the crypto module in nginx with njs 0.9.7? (for me the import cr from "crypto" and var cr = require("crypto") are already not working so not sure if i can steer around that)

To be clear in the njs binary it is working for me just not in nginx or when running nginx -t.

[kaiwu]

the crypto.subtle.* functions can be used right away without any import/require.

if you grep njs_http_js_addon_modules, the crypto modules are not included for nginx

[ap-wtioit]

Well in 0.9.6 the crypto module is working and the documentation reads as if should work even better in 0.9.7 with supporting updated algorithms:
https://nginx.org/en/docs/njs/reference.html#crypto

But it does no longer work in nginx with njs 0.9.7.

[xeioex]

HI @ap-wtioit and @kaiwu,

Thank you for the report.

Yes, the built-in crypto modules is missing from nginx modules due to missed addon linking. We did not have tests for that.

I plan to release the bugfix release tomorrow.

[IdlePhysicist]

Any timeline on when there will GH release for 0.9.8?

[xeioex]

@IdlePhysicist,

In progress.

[lancedockins]

@xeioex can you release this patch as 0.9.8 as soon as it's validated instead of waiting for a long release cycle as typical? There are some significant bugs in 0.9.6 that 0.9.7 fixes. But because of the addition of backwards compatibility breaking bugs in 0.9.7, when we upgraded to 0.9.7 it started breaking a bunch of other things. We're going to have to revert back to 0.9.6 again now. The bug after bug after bug chain is beginning to get a bit obnoxious. Bugs happen. But the fatal variety seem like they've become a bit more frequent as of late. Apologies in regards to the frustration. We're just getting hit with repeat impossible choice scenarios lately.