vetkit.resilience.blocking-call-in-handler.js-password-hash
$FN hashes a password synchronously. Password checks run on the login and sign-up request path, and bcrypt's cost factor makes each call take tens to hundreds of milliseconds, during which the Node.js process serves no other request.
Last updated:
Suite: Production readiness
javascript, typescript
$FN hashes a password synchronously. Password checks run on the login and sign-up request path, and bcrypt's cost factor makes each call take tens to hundreds of milliseconds, during which the Node.js process serves no other request.
Category: RESILIENCE · Engine rule severity: WARNING
How to fix it
Use the asynchronous API and await it: await bcrypt.hash(password, rounds) and await bcrypt.compare(password, hash) (bcrypt and bcrypt-ts run the work off the main thread; bcryptjs at least yields between rounds).
References
Source: packages/engine/rules/resilience/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.