[GH-ISSUE #3498] "Buffer" is not exported by "__vite-browser-external" #9625

New Issue

2026-04-13T05:12:12-05:00

GiteaMirror commented

2026-04-13 05:12:12 -05:00

Originally created by @asterikx on GitHub (Jul 20, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/3498

Is this suited for github?

Yes, this is suited for github

To Reproduce

Building a Tanstack Start app (i.e. using Vite) results in the following error after upgrading from 1.2.12 to 1.3.1:

✗ Build failed in 5.16s
error during build:
../../node_modules/better-auth/node_modules/jose/dist/node/esm/runtime/base64url.js (1:9): "Buffer" is not exported by "__vite-browser-external", imported by "../../node_modules/better-auth/node_modules/jose/dist/node/esm/runtime/base64url.js".
file: /Users/asterikx/monorepo/node_modules/better-auth/node_modules/jose/dist/node/esm/runtime/base64url.js:1:9

1: import { Buffer } from 'node:buffer';
            ^
2: import { decoder } from '../lib/buffer_utils.js';
3: function normalize(input) {

    at getRollupError (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/parseAst.js:401:41)
    at error (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/parseAst.js:397:42)
    at Module.error (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:16803:16)
    at Module.traceVariable (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:17252:29)
    at ModuleScope.findVariable (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:14901:39)
    at ReturnValueScope.findVariable (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:5620:38)
    at FunctionBodyScope.findVariable (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:5620:38)
    at MemberExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:7324:49)
    at CallExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23)
    at CallExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:11986:15)
    at MemberExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23)
    at MemberExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:7339:19)
    at CallExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23)
    at CallExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:11986:15)
    at ArrowFunctionExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23)
    at VariableDeclarator.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23)
    at VariableDeclaration.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2781:28)
    at Program.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2781:28)
    at Module.bindReferences (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:16782:18)
    at Graph.sortModules (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:22571:20)
    at Graph.build (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:22469:14)
    at async file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:23157:13
    at async catchUnfinishedHookActions (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:22628:16)
    at async rollupInternal (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:23152:5)
    at async buildEnvironment (file:///Users/asterikx/monorepo/node_modules/vite/dist/node/chunks/dep-Bg4HVnP5.js:34135:12)
    at async Object.build (file:///Users/asterikx/monorepo/node_modules/vite/dist/node/chunks/dep-Bg4HVnP5.js:34490:19)
    at async Object.buildApp (file:///Users/asterikx/monorepo/node_modules/@tanstack/start-plugin-core/dist/esm/nitro-plugin/plugin.js:45:15)
    at async Object.buildApp (file:///Users/asterikx/monorepo/node_modules/vite/dist/node/chunks/dep-Bg4HVnP5.js:34486:38)
    at async CAC.<anonymous> (file:///Users/asterikx/monorepo/node_modules/vite/dist/node/cli.js:642:3)
Command failed with exit code 1: /Users/asterikx/monorepo/node_modules/.bin/vite build
error: script "build" exited with code 1
error: script "deploy" exited with code 1

Current vs. Expected behavior

No build errors

What version of Better Auth are you using?

1.3.1

Originally created by @asterikx on GitHub (Jul 20, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/3498 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Building a Tanstack Start app (i.e. using Vite) results in the following error after upgrading from 1.2.12 to 1.3.1: ```txt ✗ Build failed in 5.16s error during build: ../../node_modules/better-auth/node_modules/jose/dist/node/esm/runtime/base64url.js (1:9): "Buffer" is not exported by "__vite-browser-external", imported by "../../node_modules/better-auth/node_modules/jose/dist/node/esm/runtime/base64url.js". file: /Users/asterikx/monorepo/node_modules/better-auth/node_modules/jose/dist/node/esm/runtime/base64url.js:1:9 1: import { Buffer } from 'node:buffer'; ^ 2: import { decoder } from '../lib/buffer_utils.js'; 3: function normalize(input) { at getRollupError (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/parseAst.js:401:41) at error (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/parseAst.js:397:42) at Module.error (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:16803:16) at Module.traceVariable (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:17252:29) at ModuleScope.findVariable (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:14901:39) at ReturnValueScope.findVariable (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:5620:38) at FunctionBodyScope.findVariable (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:5620:38) at MemberExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:7324:49) at CallExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23) at CallExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:11986:15) at MemberExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23) at MemberExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:7339:19) at CallExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23) at CallExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:11986:15) at ArrowFunctionExpression.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23) at VariableDeclarator.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2785:23) at VariableDeclaration.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2781:28) at Program.bind (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:2781:28) at Module.bindReferences (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:16782:18) at Graph.sortModules (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:22571:20) at Graph.build (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:22469:14) at async file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:23157:13 at async catchUnfinishedHookActions (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:22628:16) at async rollupInternal (file:///Users/asterikx/monorepo/node_modules/rollup/dist/es/shared/node-entry.js:23152:5) at async buildEnvironment (file:///Users/asterikx/monorepo/node_modules/vite/dist/node/chunks/dep-Bg4HVnP5.js:34135:12) at async Object.build (file:///Users/asterikx/monorepo/node_modules/vite/dist/node/chunks/dep-Bg4HVnP5.js:34490:19) at async Object.buildApp (file:///Users/asterikx/monorepo/node_modules/@tanstack/start-plugin-core/dist/esm/nitro-plugin/plugin.js:45:15) at async Object.buildApp (file:///Users/asterikx/monorepo/node_modules/vite/dist/node/chunks/dep-Bg4HVnP5.js:34486:38) at async CAC.<anonymous> (file:///Users/asterikx/monorepo/node_modules/vite/dist/node/cli.js:642:3) Command failed with exit code 1: /Users/asterikx/monorepo/node_modules/.bin/vite build error: script "build" exited with code 1 error: script "deploy" exited with code 1 ``` ### Current vs. Expected behavior No build errors ### What version of Better Auth are you using? 1.3.1

GiteaMirror added the locked label 2026-04-13 05:12:12 -05:00

GiteaMirror closed this issue

2026-04-13 05:12:13 -05:00

GiteaMirror commented

2026-04-13 05:12:15 -05:00

@dosubot[bot] commented on GitHub (Jul 20, 2025):

Hi @asterikx! I'm Dosu and I’m helping the better-auth team.

This error happens because the ESM-only jose library (a dependency of better-auth) imports Node.js built-ins like Buffer, which aren't available in browser builds unless polyfilled. The better-auth package tries to separate client and server code, but if you import from the default entrypoint (import { betterAuth } from "better-auth"), Vite may bundle server-only code (and thus jose and Buffer) into your client build, causing this error.

To avoid this, always import from the explicit client entrypoint:

import { betterAuth } from "better-auth/client"

This ensures only browser-safe code is included in your client bundle and avoids pulling in jose or Node.js modules like Buffer source.

If you must use the default entrypoint, you would need to configure Vite to polyfill Node.js built-ins, but this is not recommended and can lead to other issues. There is currently no official better-auth or jose documentation for Vite-specific polyfills or workarounds source.

Switching your import to "better-auth/client" should resolve the build error. If you still see issues, double-check all imports and dependencies to ensure nothing is pulling in server-only code on the client.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Jul 20, 2025):  Hi @asterikx! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team.  This error happens because the ESM-only `jose` library (a dependency of better-auth) imports Node.js built-ins like `Buffer`, which aren't available in browser builds unless polyfilled. The better-auth package tries to separate client and server code, but if you import from the default entrypoint (`import { betterAuth } from "better-auth"`), Vite may bundle server-only code (and thus `jose` and `Buffer`) into your client build, causing this error. To avoid this, always import from the explicit client entrypoint: ```js import { betterAuth } from "better-auth/client" ``` This ensures only browser-safe code is included in your client bundle and avoids pulling in `jose` or Node.js modules like `Buffer` [source](https://github.com/better-auth/better-auth/blob/99460c6325fef3661bc990826e8ae71933516330/packages/better-auth/src/client/index.ts). If you must use the default entrypoint, you would need to configure Vite to polyfill Node.js built-ins, but this is not recommended and can lead to other issues. There is currently no official better-auth or jose documentation for Vite-specific polyfills or workarounds [source](https://better-auth.com/docs/basic-usage). Switching your import to `"better-auth/client"` should resolve the build error. If you still see issues, double-check all imports and dependencies to ensure nothing is pulling in server-only code on the client.  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/a50c4fdd-e9fc-4cd9-9462-6a9612f2cb10?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a50c4fdd-e9fc-4cd9-9462-6a9612f2cb10?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a50c4fdd-e9fc-4cd9-9462-6a9612f2cb10?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a50c4fdd-e9fc-4cd9-9462-6a9612f2cb10?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a50c4fdd-e9fc-4cd9-9462-6a9612f2cb10?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a50c4fdd-e9fc-4cd9-9462-6a9612f2cb10?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a50c4fdd-e9fc-4cd9-9462-6a9612f2cb10?feedback_type=other)</sup>  [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/3498)

GiteaMirror commented

2026-04-13 05:12:16 -05:00

@Kinfe123 commented on GitHub (Jul 21, 2025):

What version node are you using ?

@Kinfe123 commented on GitHub (Jul 21, 2025): What version node are you using ?

GiteaMirror commented

2026-04-13 05:12:17 -05:00

@asterikx commented on GitHub (Jul 21, 2025):

@Kinfe123 I'm running on Node v22.16.0.
When I downgrade to better-auth@1.2.12 everything works again as expected.

@asterikx commented on GitHub (Jul 21, 2025): @Kinfe123 I'm running on Node v22.16.0. When I downgrade to `better-auth@1.2.12` everything works again as expected.

GiteaMirror commented

2026-04-13 05:12:19 -05:00

@Kinfe123 commented on GitHub (Jul 21, 2025):

can you try upgrade node to v23.6.0 or something latest ?

@Kinfe123 commented on GitHub (Jul 21, 2025): can you try upgrade node to v23.6.0 or something latest ?

GiteaMirror commented

2026-04-13 05:12:20 -05:00

@asterikx commented on GitHub (Jul 21, 2025):

With v22.17.1 (latest LTS) and v24.4.1 (latest stable version) I get the same build error as above and the same client-side error in development:

(0 , import_node_util.promisify) is not a function

and browser console warnings:

Module "node:crypto" has been externalized for browser compatibility. Cannot access "node:crypto.webcrypto" in client code. See https://vite.dev/guide/troubleshooting.html#module-externalized-for-browser-compatibility for more details.
Module "node:util" has been externalized for browser compatibility. Cannot access "node:util.promisify" in client code. See https://vite.dev/guide/troubleshooting.html#module-externalized-for-browser-compatibility for more details.
Module "node:crypto" has been externalized for browser compatibility. Cannot access "node:crypto.generateKeyPair" in client code. See https://vite.dev/guide/troubleshooting.html#module-externalized-for-browser-compatibility for more details.

@asterikx commented on GitHub (Jul 21, 2025): With v22.17.1 (latest LTS) and v24.4.1 (latest stable version) I get the same build error as above and the same client-side error in development: ``` (0 , import_node_util.promisify) is not a function ``` and browser console warnings: ``` Module "node:crypto" has been externalized for browser compatibility. Cannot access "node:crypto.webcrypto" in client code. See https://vite.dev/guide/troubleshooting.html#module-externalized-for-browser-compatibility for more details. Module "node:util" has been externalized for browser compatibility. Cannot access "node:util.promisify" in client code. See https://vite.dev/guide/troubleshooting.html#module-externalized-for-browser-compatibility for more details. Module "node:crypto" has been externalized for browser compatibility. Cannot access "node:crypto.generateKeyPair" in client code. See https://vite.dev/guide/troubleshooting.html#module-externalized-for-browser-compatibility for more details. ```

GiteaMirror commented

2026-04-13 05:12:21 -05:00

@asterikx commented on GitHub (Aug 2, 2025):

The error no longer seems to occur with better-auth version 1.3.4.

@asterikx commented on GitHub (Aug 2, 2025): The error no longer seems to occur with better-auth version 1.3.4.

Sign in to join this conversation.

Branches Tags

2026-07-27/fix/preserve-password-reset-otp

dependabot/npm_and_yarn/demo/electron/demo-minor-patch-2a3bb054a0

changeset-release/main

main

dependabot/github_actions/github-actions-42c4bc6a62

fix/typecheck-coverage-next

changeset-release/next

fix/oauth-provider-session-deletion

feat/scim-demo-workflow

feat/scim-active-user-link

feat/sso-provider-user-resolution

feat/identity-provider-accounts

2026-07-18/fix/expo-secure-store-async

feat/oauth-provider-remove-silence-warnings

changeset-release/release/vercel-announcement

release/vercel-announcement

2026-06-29/docs/optimize-og-images

feat/yandex-social-provider

feat/ssrf-fetch-boundary

codex/pr-10225-next-comments

fix/phone-number-disable-input

perf/router-build-once

fix/oauth-user-provisioning-fields

codex/ignore-compose-override-spellcheck

2026-06-19/fix/stripe-org-reference-scope

feat/webhooks

feat/baseurl-canonical-serving-split

feat/magic-link-expires-in

fix/esbuild-security-bump

chore/sync-main-to-next-20260615

chore/revert-10053

codex/fix-expo-sdk56-dynamic-import

refactor/oauth-provider-client-authentication-module

fix/oauth-no-store-headers

claude/slack-update-stripe-docs-consistency-8Sc0w

local/fix-invite-accept-idempotency

docs/beta-mdx-component-fallback

fix/dependabot-hono-shell-quote

codex/stateless-account-cookie-resolution

fix/admin-create-user-role-escalation

feat/oauth-provider-oidc-acr

refactor/sign-in-challenges

refactor/optional-kysely-dependency

2026-06-06/chore/kysely-changeset

copilot/fix-code-review-comment

starsling/prisma-migration-reset

2026-06-02/fix/next-cookies-defer-rsc

feat/oauth-contribution-protocol

ping-maxwell/c-ping-maxwell/fix-kysely-adapter-core-utils-string-resolution-68c5

temp/server-only-test

2026-05-31/refactor/kysely-joins-json-helpers

2026-04-29/feat/google-include-granted-scopes

2026-04-29/fix/oauth-account-scope-semantics

fix/oauth-callback-path-declarative

2026-05-31/fix/sqlite-dialect-affected-rows

fix/next-cookie-separator

2026-05-29/fix/last-login-method-cookie-prefix

feat/oauth-provider-custom-subject

ping-maxwell/c-ping-maxwell/fix-error-link-apostrophe-f89a

client-assertions-main

2026-05-15/ci/fix-sqlite-abi-mismatch

2026-05-15/fix/organization-team-add-cascade

2026-05-15/fix/parse-set-cookie-value-validation

2026-05-13/feat/captcha-wildcard-endpoints

fix/i18n-before-hook-translation

fix/disable-migration-generate

2026-05-10/fix/cookie-drain-order

2026-05-10/feat/hooks-finally

2026-05-09/fix/cookie-drain-order

2026-05-09/feat/hooks-finally

2026-05-08/feat/register-before-send

fix/stripe/subscription-data-merge

2026-05-01/chore/pnpm-v11-harden

chore/pnpm-v11

2026-04-27/fix/nextcookies-idempotent-writes

2026-04-26/fix/harden-proxy-host-validation

2026-04-26/refactor/stripe-callback-signature-cleanup

2026-04-26/fix/stripe-subscription-callback-timing

2026-04-11/fix/sveltekit-app-modules

feat/open-api-zod-contract

feat/oauth-idp-initiated-bounce

2026-04-21/fix/oauth-rfc-input-validation

fix/two-factor-identity-guard

fix/resource

feat/emailpassword-authorize

feat/oauth-provider-at-hash-v2

fix/release-grep-fallback

claude/address-review-comments-JhFLr

feat/async-auth

fix/two-factor-totp-verified-enrollment

feat/plugin-ui

codex/blog-1-6-release-post

2026-04-06/fix/type-any-guards

2026-04-05/chore/downgrade-better-call

2026-04-04/ci/skip-vercel-fork-prs

2026-03-28/ci/add-autofix-ci

chore/release-preview-script

himself65/2026/02/19/role

2026-03-20/docs/improve-website

2026-03-20/fix/anonymous-onlinkaccount-expo

2026-02-17/fix/anonymous-link-state

fix/8607-saml-inresponseto

fix/8549-scim-patch-noop

v1.4.x

refactor/migration-snapshot-tests

worktree-magic-link-additional-data

chore/migrate-build-to-rollup

worktree-fix-dynamic-baseurl-8447

2026-03-06/chore/public-api-check

fix/close-8156-regression-test

fix/secondary-storage-json-error-handling

himself65/verification-namespace

cursor/issue-8307-validation-79a3

himself65/2026/01/30/error-mdx

v1.4.x-staging

fix/email-otp-user

fix/restrict-full-organization-access-roles

himself65/2026/02/12/count

himself65/2026/02/04/define-plugin

2026-02-04/feat/add-pluralize

cursor/better-auth-js-integration-ec21

cursor/expo-state-mismatch-394c

2026-02-01/fix/org-update-role-sync-members

cursor/issue-7607-investigation-e146

cursor/email-generation-helper-0ff6

himself65/2026/01/21/avoid-spread-operator

himself65/2026/01/14/cli

claude/slack-add-docs-pr-NMvgO

claude/slack-add-advanced-useplural-WHKYL

feat/hooks-pos

feat/2fa-phone

feat/2fa

fix/rotation

fix/username-check

v1.3.x

refactor/organization

feat/multiple-client-ids-social-providers

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/better-auth#9625