Fix Error: error:1C80006B:Provider routines::wrong final block length in Node.js

This error occurs when decrypting data with an incorrect key, wrong IV, or corrupted ciphertext, causing the padding validation to fail. The cipher expects specific block alignment that does not match the input. Fix it by ensuring the encryption key, IV, and algorithm match between encryption and decryption.

Reading the Stack Trace

Here's what each line means:

• at Decipheriv.final (node:internal/crypto/cipher:193:29): The decipher's final() call failed because the decrypted data has invalid PKCS7 padding, indicating wrong key or corrupted data.
• at decrypt (src/utils/encryption.js:24:28): Your encryption utility at line 24 calls decipher.final() which validates padding and fails with mismatched keys.
• at TokenService.verify (src/services/tokenService.js:18:22): The token service tries to decrypt a token that was encrypted with a different key or algorithm.

Common Causes

const crypto = require('crypto');
const key = process.env.ENCRYPTION_KEY; // Changed after tokens were issued
const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
decipher.update(encrypted);
decipher.final(); // Fails: wrong key

function encrypt(text) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
  return cipher.update(text) + cipher.final(); // IV is lost
}

// Encryption: outputs hex
const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
// Decryption: expects base64
decipher.update(encrypted, 'base64', 'utf8'); // Wrong encoding

The Fix

Generate a random IV for each encryption and prepend it to the ciphertext. On decryption, extract the IV from the payload before decrypting. Use consistent Buffer encoding throughout to avoid corruption. Validate the payload format before attempting decryption.

const crypto = require('crypto');

function encrypt(text, key) {
  const cipher = crypto.createCipheriv('aes-256-cbc', key, Buffer.alloc(16));
  return cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
}

function decrypt(encrypted, key) {
  const decipher = crypto.createDecipheriv('aes-256-cbc', key, Buffer.alloc(16));
  return decipher.update(encrypted, 'hex', 'utf8') + decipher.final('utf8');
}

const crypto = require('crypto');

const ALGORITHM = 'aes-256-cbc';
const IV_LENGTH = 16;

function encrypt(text, key) {
  const iv = crypto.randomBytes(IV_LENGTH);
  const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(key, 'hex'), iv);
  const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
  return iv.toString('hex') + ':' + encrypted.toString('hex');
}

function decrypt(payload, key) {
  const [ivHex, encryptedHex] = payload.split(':');
  if (!ivHex || !encryptedHex) {
    throw new Error('Invalid encrypted payload format');
  }
  const iv = Buffer.from(ivHex, 'hex');
  const encrypted = Buffer.from(encryptedHex, 'hex');
  const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(key, 'hex'), iv);
  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf8');
}

Testing the Fix

const { encrypt, decrypt } = require('./encryption');
const crypto = require('crypto');

const key = crypto.randomBytes(32).toString('hex');

describe('Encryption', () => {
  it('encrypts and decrypts a string successfully', () => {
    const text = 'hello world';
    const encrypted = encrypt(text, key);
    const decrypted = decrypt(encrypted, key);
    expect(decrypted).toBe(text);
  });

  it('produces different ciphertext for same input (random IV)', () => {
    const text = 'test';
    const a = encrypt(text, key);
    const b = encrypt(text, key);
    expect(a).not.toBe(b);
  });

  it('throws on invalid payload format', () => {
    expect(() => decrypt('invalidpayload', key)).toThrow('Invalid encrypted payload format');
  });

  it('throws when decrypting with wrong key', () => {
    const encrypted = encrypt('secret', key);
    const wrongKey = crypto.randomBytes(32).toString('hex');
    expect(() => decrypt(encrypted, wrongKey)).toThrow();
  });
});

Run your tests:

npm test

Pushing Through CI/CD

git checkout -b fix/nodejs-crypto-error,git add src/utils/encryption.js src/utils/__tests__/encryption.test.js,git commit -m "fix: use random IV and consistent encoding for crypto operations",git push origin fix/nodejs-crypto-error

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm test -- --coverage
      - run: npm run lint

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

npm install bugstack-sdk

const { initBugStack } = require('bugstack-sdk')

initBugStack({ apiKey: process.env.BUGSTACK_API_KEY })

Deploying the Fix (Manual Path)

1. Update encryption functions to use random IVs prepended to ciphertext.
2. Ensure consistent encoding (hex or base64) between encrypt and decrypt.
3. Run tests to verify round-trip encryption/decryption.
4. Plan a migration for existing encrypted data if key format changed.
5. Open a PR, merge after CI, and verify in staging.

Frequently Asked Questions