Node.js 24

TypeError: crypto.createCipher is not a function

TypeError: crypto.createCipher is not a function

What it means

crypto.createCipher and crypto.createDecipher were removed in Node.js 22.

Why it happens

Deprecated since Node 10 (DEP0106) for using a weak, salt-less MD5 key derivation and a static IV, createCipher/createDecipher were removed in Node.js 22. Code (or a dependency) still calls them and now throws after the runtime upgrade.

How to fix it

  1. Switch to `crypto.createCipheriv(algorithm, key, iv)` / `crypto.createDecipheriv(...)` with an explicit key and IV.
  2. Derive the key with `crypto.scryptSync(password, salt, keylen)` (or `crypto.pbkdf2`) and a random IV from `crypto.randomBytes(16)`; store the IV alongside the ciphertext.
  3. To read legacy data made with the old createCipher, re-implement its OpenSSL EVP_BytesToKey(MD5) derivation once, then re-encrypt under the new scheme.
  4. Upgrade any dependency that still calls createCipher to a current release.

Related deadline: Lambda Node.js 18 create/update restrictions — 2027-02-01.

Check configured patterns in your project

The free EOLkits scanner processes files in your browser and flags selected related patterns in supported IaC and dependency files. File names and contents are not uploaded; bounded aggregate file and finding counts may be sent. It is not a complete source or AWS-account scan.

Prefer a 10-second check? Paste your config into the free AWS EOL checker. Pasted input is not uploaded; bounded first-party usage events may be sent.

Primary source: https://nodejs.org/api/deprecations.html

Inspect the $299 report sample and availability →