PostgreSQL · sdk · fg-0270
node-postgres fails with 'SASL: SCRAM-SERVER-FIRST-MESSAGE: client password must be a string'
Error: SASL: SCRAM-SERVER-FIRST-MESSAGE: client password must be a string
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
The password reached pg as undefined, almost always because the database URL or PGPASSWORD was not loaded into the process. PostgreSQL 14 made scram-sha-256 the default password encryption, so the failure surfaces inside the SCRAM handshake instead of as a plain login error.
Fix
Load the environment before creating the pool and fail fast when the URL is missing.
Apply
import 'dotenv/config'
import pg from 'pg'
if (!process.env.DATABASE_URL) throw new Error('DATABASE_URL is not set')
export const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL })Affects: pg 8.x against PostgreSQL 14 and later, or any server using scram-sha-256
Sources
- https://github.com/brianc/node-postgres/blob/master/packages/pg/lib/crypto/sasl.js
- https://github.com/brianc/node-postgres/issues/2757
- https://www.postgresql.org/docs/release/14.0/
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp