If you recently upgraded your Lambda function to Node.js 22 and encountered the error 'TypeError: crypto.createCipher is not a function', you are not alone. This failure has affected thousands of developers who relied on a crypto API that had been deprecated for years. In this article we explain why it was removed, how to migrate properly, and how at Q2BSTUDIO we tackle such technical challenges with a focus on secure and modern custom software solutions.
The crypto.createCipher() function internally used OpenSSL's EVP_BytesToKey, deriving the encryption key from a password using a single MD5 hash without salt. This means two encryptions with the same password produce identical keys, enabling dictionary and rainbow table attacks. Moreover, a single MD5 iteration allows billions of password guesses per second on commodity hardware. For these reasons, Node.js started showing deprecation warnings in version 10, turned them into runtime warnings in v11, and finally removed the function in v22.0.0. On AWS Lambda, the nodejs20.x runtime has been deprecated since April 2026 (no security patches), and migration to nodejs22.x is mandatory before February 2027. Companies that are moving early are now hitting this error.
The official replacement is crypto.createCipheriv(), which requires you to explicitly provide a key and initialization vector (IV). To derive a key from a password, robust functions like scryptSync or pbkdf2Sync are recommended. The following pattern is safe and compatible with Node.js 22: generate a random 16-byte salt with crypto.randomBytes(), a random IV, derive the key using scrypt with that salt, and then encrypt with createCipheriv. The result must be stored along with the salt and IV for later decryption. This eliminates the security risks of the old method. From Q2BSTUDIO we recommend integrating this migration into a cloud modernization plan, as it is also a great opportunity to review other insecure dependencies and adopt cybersecurity best practices.
If you already have data encrypted with the old API, migration requires an intermediate step: decrypt the data using an older Node.js version (≤21) that still has createCipher, and then re-encrypt it with the new method. This is a delicate process that must be done carefully to avoid data loss. At Q2BSTUDIO we offer cybersecurity and cloud consulting services (AWS/Azure) to help companies perform these transitions without risk, minimizing downtime and ensuring data integrity.
Beyond encryption, this change is a reminder that technical obsolescence doesn't give much notice. To keep your applications up to date, it's helpful to use automated analysis tools, such as AI agents that scan dependencies in your code and alert you about deprecated functions. At Q2BSTUDIO we integrate artificial intelligence into our development processes to detect vulnerabilities and optimize performance. We also build dashboards with Power BI that monitor the status of your Lambda functions, helping you plan upgrades before they become emergencies. If you need a complete solution, our custom software team can redesign your encryption system and adapt it to the latest Node.js versions, ensuring compatibility and security.
In summary, the createCipher is not a function error in Node.js 22 Lambda is not a bug but the result of a necessary security policy. Migrating to createCipheriv with proper key derivation not only fixes the error but protects your data against modern attacks. At Q2BSTUDIO we are ready to help you through this process, whether via cloud consulting, custom software development, or AI agent integration. Don't leave the migration to the last minute: the nodejs20.x runtime no longer receives patches and the upgrade window is closing soon. Contact us and secure the future of your cloud applications.
