Registry / http-networking / safer-buffer

safer-buffer

library2.1.2jsnpmunverified

A polyfill for the modern Buffer API (Buffer.alloc, Buffer.from, Buffer.allocUnsafe, Buffer.allocUnsafeSlow) that works on Node.js from 0.8 to current, but unlike safe-buffer it does not silently allow the deprecated Buffer() constructor. Latest version: 2.1.2. This package is a drop-in replacement that forces the use of the safe API by exporting only the safe Buffer methods, eliminating the security footgun of uninitialized memory allocation. It is intended as a temporary measure for projects that must support older Node.js versions. For modern Node.js (>=4.5.0 and >=5.9.0), direct use of the built-in Buffer.alloc and Buffer.from is recommended.

http-networking

npm install safer-buffer

github ↗package ↗

INSTALL

IMPORT

SIG · SAFER-BUFFER

safer-buffer

http-networkingjavascriptv2.1.2

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Buffer

✓ const Buffer = require('safer-buffer').Buffer

✗ const Buffer = require('safer-buffer')

The module exports an object with a Buffer property. The default export is not a Buffer constructor.

SaferBuffer

✓ import { Buffer } from 'safer-buffer'

✗ import SaferBuffer from 'safer-buffer'

ESM named import is required; there is no default export. For ESM environments, use import { Buffer } from 'safer-buffer'.

Buffer.alloc

✓ Buffer.alloc(size, fill, encoding)

✗ Buffer.allocUnsafe(size)

Buffer.alloc is safe (initializes memory). Buffer.allocUnsafe returns uninitialized memory and should be used with caution.

Buffer.from

✓ Buffer.from(array)

✗ new Buffer(array)

Buffer.from is the safe way to create a buffer from data. new Buffer() is deprecated and unsafe in older Node.js.

Demonstrates safe Buffer usage with safer-buffer: alloc, from, concat, and the prevention of the unsafe Buffer() constructor.

const Buffer = require('safer-buffer').Buffer; // Safe allocation (initialized to zero) const buf1 = Buffer.alloc(10); console.log(buf1); // <Buffer 00 00 00 00 00 00 00 00 00 00> // Safe creation from string const buf2 = Buffer.from('hello', 'utf8'); console.log(buf2.toString()); // 'hello' // Safe concatenation const buf3 = Buffer.concat([buf1, buf2]); console.log(buf3.length); // 15 // Note: The following would throw an error because Buffer() is not exported: // const buf4 = Buffer(10); // TypeError: Buffer is not a function (or similar) // To use the deprecated API (unsafe), you must explicitly require the original buffer const OriginalBuffer = require('buffer').Buffer; const unsafeBuf = new OriginalBuffer(10); // not recommended

Debug

Known issues

breakingsafer-buffer does not export the Buffer() constructor; only Buffer.alloc, Buffer.allocUnsafe, Buffer.allocUnsafeSlow, and Buffer.from are available. Using Buffer(10) will throw a ReferenceError or TypeError.

fix

Replace all Buffer() and new Buffer() calls with Buffer.alloc() or Buffer.from() accordingly.

affects: >=2.0.0

deprecatedsafer-buffer is a polyfill for older Node.js versions. For Node.js >=4.5.0 or >=5.9.0, the built-in Buffer supports the safe API directly. Using this package on modern Node is unnecessary and may mask code that should be updated.

fix

Remove the require/import of safer-buffer and use the global Buffer (which already has .alloc and .from) if your minimum Node version is 4.5+ or 5.9+.

affects: >=2.0.0

gotchaWhen using ES modules (import), the package must be imported as import { Buffer } from 'safer-buffer'. There is no default export.

fix

Use import { Buffer } from 'safer-buffer'; do not use import SaferBuffer from 'safer-buffer'.

affects: >=2.0.0

gotchaThe package does not replace the global Buffer object in the Node.js environment. It only exports a safe Buffer constructor. Code that uses the global Buffer (e.g., in browser environments or Node's global) will still use the original unsafe Buffer if not shadowed.

fix

Always assign the result of require('safer-buffer').Buffer to a local variable named Buffer in each module that needs it.

affects: >=2.0.0

deprecatedThe safe-buffer package (predecessor) is known to silently allow unsafe usage. safer-buffer was created to fix that. If you are migrating from safe-buffer, ensure you replace all require('safe-buffer') with require('safer-buffer') and update the import pattern.

fix

Replace const Buffer = require('safe-buffer').Buffer with const Buffer = require('safer-buffer').Buffer.

affects: >=2.0.0

Errors

Common errors & fixes

TypeError: Buffer is not a function

Trying to call Buffer() as a function after require('safer-buffer').Buffer

fix

Use Buffer.alloc() or Buffer.from() instead of Buffer().

ReferenceError: Buffer is not defined

Not importing the Buffer from safer-buffer, or expecting it to be global (global Buffer may not be polyfilled).

fix

Add const Buffer = require('safer-buffer').Buffer at the top of the file.

TypeError: (intermediate value).Buffer is not a constructor

Using require('safer-buffer') directly (without .Buffer) and then trying to call it as a constructor.

fix

Use require('safer-buffer').Buffer instead of require('safer-buffer').

Upgrade

Version history

2.1.2latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

8 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/ChALkeR/safer-buffer ↗

packagehttps://www.npmjs.com/package/safer-buffer ↗