[Bug]: (35.0.2) Fix Undefined constant PASSWORD_ARGON2ID in OCSecurityHasher

⚠️ This issue respects the following points: ⚠️

This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
I agree to follow Nextcloud's Code of Conduct.
I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

The installation fails with an HTTP 500 Internal Server Error.

nextcloud.log contains an error similar to:

Error: Undefined constant "OC\\Security\\PASSWORD_ARGON2ID"
File: lib/private/Security/Hasher.php

Steps to reproduce

Install Nextcloud on a PHP environment compiled without Argon2 support (--with-password-argon2 not enabled).
Open the Nextcloud setup wizard.
Enter an admin username and password.
Start the installation process.

NC35_Hasher_issue.mp4

Expected behavior

Nextcloud should detect that Argon2 is unavailable and automatically fall back to PASSWORD_BCRYPT, allowing the installation and user creation process to complete successfully.

Nextcloud Server version

35

Operating system

Other

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

SQlite

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

Default user-backend (database)
LDAP/ Active Directory
SSO - SAML
Other

Configuration report

% /usr/local/php/8.3/bin/php -v
PHP 8.3.36 (cli) (built: Oct 21 2026 22:43:34) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies
%

% cat composer.json | grep php
                        "php": "8.3"
                        "lib/public/Log/functions.php"
                "php": "^8.3",
                "cs:fix": "php-cs-fixer fix",
                "cs:check": "php-cs-fixer fix --dry-run --diff",
                "lint": "find . -type f -name '*.php' -not -path './3rdparty/*' -not -path '*/composer/*' -not -path '*/stubs/*' -not -path '*/vendor-bin/*' -not -path '*/vendor/*' -print0 | xargs -0 -n200 -P$(nproc) php -l",
                        "php -f occ config:system:set 'overwrite.cli.url' --type string --value \"http://${NEXTCLOUD_HOST:=localhost}:${NEXTCLOUD_PORT:=8080}\"",
                        "PHP_CLI_SERVER_WORKERS=${NEXTCLOUD_WORKERS:=4} php -S ${NEXTCLOUD_HOST:=localhost}:${NEXTCLOUD_PORT:=8080} -t ./"
                        "phpunit --fail-on-warning --fail-on-risky --display-warnings --display-deprecations --display-phpunit-deprecations --display-skipped --colors=always --configuration tests/phpunit-autotest.xml"
                "test:files_external": "phpunit --fail-on-warning --fail-on-risky --display-warnings --display-deprecations --display-phpunit-deprecations --colors=always --configuration tests/phpunit-autotest-external.xml",
                "rector": "rector --config=build/rector.php && composer cs:fix",
                "rector:strict": "rector --config=build/rector-strict.php && composer cs:fix",
%

% /usr/local/php/8.3/bin/php -r "var_dump(defined('PASSWORD_ARGON2ID')); var_dump(defined('PASSWORD_ARGON2I'));"
bool(false)
bool(false)
%

% php -r "var_dump(defined('PASSWORD_ARGON2ID')); var_dump(defined('PASSWORD_ARGON2I'));"
bool(false)
bool(false)
%

% php occ config:list system
This version of Nextcloud requires at least PHP 8.3<br/>You are currently running 7.4.33. Please update your PHP version.
%

List of activated Apps

% /usr/local/php/8.3/bin/php occ app:list
The process control (PCNTL) extensions are required in case you want to interrupt long running commands - see https://www.php.net/manual/en/book.pcntl.php
Additionally the function 'pcntl_signal' and 'pcntl_signal_dispatch' need to be enabled in your php.ini.
The current PHP memory limit is below the recommended value of 512MB.
Enabled:
  - activity: 8.0.0
  - app_api: 35.0.0
  - appstore: 2.0.0
  - bruteforcesettings: 8.0.0
  - circles: 35.0.0
  - cloud_federation_api: 2.0.0
  - comments: 2.0.0
  - contactsinteraction: 2.0.0
  - dashboard: 8.0.0
  - dav: 2.0.0
  - federatedfilesharing: 2.0.0
  - federation: 2.0.0
  - files: 3.0.0
  - files_downloadlimit: 5.3.0
  - files_lock: 35.0.1
  - files_pdfviewer: 8.0.0
  - files_reminders: 2.0.0
  - files_sharing: 2.0.0
  - files_trashbin: 2.0.0
  - files_versions: 2.0.0
  - firstrunwizard: 8.0.0
  - logreader: 8.0.0
  - lookup_server_connector: 2.0.0
  - nextcloud_announcements: 7.0.0
  - notifications: 8.0.1
  - oauth2: 2.0.0
  - office: 1.1.0
  - password_policy: 7.0.0
  - photos: 8.0.0
  - privacy: 7.0.0
  - profile: 2.0.0
  - provisioning_api: 2.0.0
  - recommendations: 8.0.0
  - related_resources: 6.0.0
  - serverinfo: 7.0.0
  - settings: 2.0.0
  - sharebymail: 2.0.0
  - sharing: 1.0.4
  - support: 7.0.0
  - survey_client: 7.0.0
  - systemtags: 2.0.0
  - text: 9.0.1
  - theming: 3.0.0
  - twofactor_backupcodes: 2.0.0
  - twofactor_totp: 17.1.0
  - updatenotification: 2.0.0
  - user_status: 2.0.0
  - viewer: 8.0.0
  - weather_status: 2.0.0
  - webhook_listeners: 2.0.0
  - workflowengine: 3.0.0
Disabled:
  - admin_audit: 2.0.0
  - encryption: 3.0.1
  - files_external: 2.0.0
  - suspicious_login: 13.0.0
  - twofactor_nextcloud_notification: 9.0.0
  - user_ldap: 2.0.0
%

% php occ app:list
This version of Nextcloud requires at least PHP 8.3<br/>You are currently running 7.4.33. Please update your PHP version.
%

Nextcloud Signing status

Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- core
	- INVALID_HASH
		- .htaccess
		- lib/private/Security/Hasher.php
	- EXTRA_FILE
		- php.cgi
		- phpinfo.php

Raw output
==========
Array
(
    [core] => Array
        (
            [INVALID_HASH] => Array
                (
                    [.htaccess] => Array
                        (
                            [expected] => a2d827cbc4eadda3ccfdcfa9391985ee63808925b3cf2a43683296de37bcbcab4075ab0c49c3898ada1dd5f71100a673e166ce5f87c002bf18a3960385f7823c
                            [current] => 71c98d893041e804355b1aa354ea010ba96579c070554623403dd830b5a6a2e080d0660e08c049312224b77a495a1275a41c3ae0b0d84eb5b1084dcf8965066b
                        )

                    [lib/private/Security/Hasher.php] => Array
                        (
                            [expected] => 4692aba926bc547b800a3c94fd27d8b5229c70532fe241aafb2c975e357beeb1a9e0767fd9225b72279d129e84e10d9f4b80d88e595b89d5aebc5b1e2bb03362
                            [current] => ed4d7f53219f8bbe4955f24d81c1aeac3a6fc2d59e45bc09f1d0c5e1bb70de0cba5399f8d8530625dc83272d6ad630085d92080e57f6de6d8530aa03da255837
                        )

                )

            [EXTRA_FILE] => Array
                (
                    [php.cgi] => Array
                        (
                            [expected] => 
                            [current] => 37d7f9dcfbb6cea00801aff89d3e234171a90fa7fbcef455d1427996bd00f2586c70ba9190d8c7841cf1f541879aa0a037a6ff3f9f17f8520d8ee9a097bd02f1
                        )

                    [phpinfo.php] => Array
                        (
                            [expected] => 
                            [current] => 4bf1c38cf81363662589f86cc66fe87c5ef586455362830ca1a38fe7b9e51e71efd3c761d73e74e020e9a3efd6e02fb38af7a13c955c375b811e53c54e4bbc66
                        )

                )

        )

)

Nextcloud Logs

{
  "level": 3,
  "message": "Undefined constant \"OC\\Security\\PASSWORD_ARGON2ID\"",
  "exception": {
    "Exception": "Error",
    "File": "lib/private/Security/Hasher.php",
    "Line": 78
  }
}

Additional info

Root cause

Hasher::getPrefferedAlgorithm() correctly checks for the existence of Argon2 constants using defined() and falls back to PASSWORD_BCRYPT when Argon2 is unavailable.

However, Hasher::hash() contains a match ($alg) expression that directly references PASSWORD_ARGON2ID and PASSWORD_ARGON2I:

$version = match ($alg) {
    PASSWORD_ARGON2ID => 3,
    PASSWORD_ARGON2I => 2,
    PASSWORD_BCRYPT => 1,
};

On PHP builds without Argon2 support, those constants are not defined. Since PHP 8+ throws an Error for undefined constants, evaluating the match expression results in a fatal error before bcrypt fallback can be used.

Proposed fix

Guard constant references with defined() checks:

$version = match (true) {
    \defined('PASSWORD_ARGON2ID') && $alg === PASSWORD_ARGON2ID => 3,
    \defined('PASSWORD_ARGON2I') && $alg === PASSWORD_ARGON2I => 2,
    $alg === PASSWORD_BCRYPT => 1,
    default => 1,
};

This preserves current behavior on Argon2-enabled systems while preventing fatal errors on systems where Argon2 support is not available.

Hasher.php

@hiro-gj

I was able to reproduce and resolve this behavior:

Environment lacked Argon2 support in PHP core, throwing Error: Undefined constant "OC\Security\PASSWORD_ARGON2ID" during setup.
Verified that ensuring PASSWORD_ARGON2ID constant support via PHP modules (php-common, php-cli with Argon2/Sodium) allows the wizard to complete smoothly without HTTP 500 errors.
For environments compiled entirely without --with-password-argon2, guarding the match expression in lib/private/Security/Hasher.php with \defined() checks properly enables the bcrypt fallback. @hiro-gj

@hiro-gj

@hiro-gj, @pk7243959-wq, what kind of environment offers php without argon2? It this the default for some distributions?

@hiro-gj

@hiro-gj can you open a PR with your proposal as a follow-up of #64733 and ping @provokateurin?

FYI, the previous code was: ee1feb8#diff-4e0e711e247c08025433254c88e877244c7b854ee3746523b75e6598a8386808

@hiro-gj

@hiro-gj, @pk7243959-wq, what kind of environment offers php without argon2? It this the default for some distributions?

It's (Japan) Sakura's Rental Server :
https://rs.sakura.ad.jp/

@artonge

10. @hiro-gj can you open a PR with your proposal as a follow-up of #64733 and ping @provokateurin?
FYI, the previous code was: ee1feb8#diff-4e0e711e247c08025433254c88e877244c7b854ee3746523b75e6598a8386808

@artonge @provokateurin Is this PR okay?

fix(Security\Hasher): Guard PASSWORD_ARGON2 constants with defined() check #65791

Navigation Menu

Repository navigation

[Bug]: (35.0.2) Fix Undefined constant `PASSWORD_ARGON2ID` in `OCSecurityHasher` #65780

⚠️ This issue respects the following points: ⚠️

Bug description

Steps to reproduce

Expected behavior

Nextcloud Server version

Operating system

PHP engine version

Web server

Database engine version

Is this bug present after an update or on a fresh install?

Are you using the Nextcloud Server Encryption module?

What user-backends are you using?

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

Root cause

Proposed fix

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Bug]: (35.0.2) Fix Undefined constant PASSWORD_ARGON2ID in OCSecurityHasher #65780

Description

⚠️ This issue respects the following points: ⚠️

Bug description

Steps to reproduce

Expected behavior

Nextcloud Server version

Operating system

PHP engine version

Web server

Database engine version

Is this bug present after an update or on a fresh install?

Are you using the Nextcloud Server Encryption module?

What user-backends are you using?

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

Root cause

Proposed fix

Activity

pk7243959-wq commented on Oct 22, 2026

artonge commented on Oct 22, 2026

artonge commented on Oct 22, 2026

hiro-gj commented on Oct 22, 2026

hiro-gj commented on Oct 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[Bug]: (35.0.2) Fix Undefined constant `PASSWORD_ARGON2ID` in `OCSecurityHasher` #65780