[P0/Blocker] Both teamsapp and atk CLIs crash on Node.js v25 — SlowBuffer removed (two crash sites)

[VikrantSingh01]

Severity: Blocker

Both @microsoft/m365agentstoolkit-cli@1.1.4 (atk) and @microsoft/teamsapp-cli@3.0.10 (teamsapp) are completely unusable on Node.js v25 — every command crashes before execution. Node 25 is the current release line. This blocks all CLI-based workflows (CI/CD, provisioning, deployment) for developers on Node 25.

Root Cause

SlowBuffer was removed from Node.js v25 (nodejs/node#56601). require('buffer').SlowBuffer returns undefined.

Two bundled dependencies access SlowBuffer.prototype at module load time without guards, causing immediate crashes:

Crash Site 1: buffer-equal-constant-time (webpack module 33789) — crashes first

var Buffer = __webpack_require__(20181).Buffer,
    SlowBuffer = __webpack_require__(20181).SlowBuffer;  // ← undefined in Node 25

// Line that crashes:
var origSlowBufEqual = SlowBuffer.prototype.equal;
// TypeError: Cannot read properties of undefined (reading 'prototype')

Dependency chain: jsonwebtoken → jws → jwa → buffer-equal-constant-time

Crash Site 2: iconv-lite (webpack module 81542) — hidden, would crash second

var SlowBuffer = __webpack_require__(20181).SlowBuffer;  // ← undefined in Node 25

// Line that would crash (currently masked by crash site 1):
original.SlowBufferToString = SlowBuffer.prototype.toString;
// TypeError: Cannot read properties of undefined (reading 'prototype')

25 total SlowBuffer references exist in the bundle across these two packages plus safer-buffer (which is safe — it only checks the string name, not .prototype).

Steps to Reproduce

node -v   # v25.6.1
npx atk --version            # crashes
npx teamsapp --version       # crashes
npx teamsapp provision       # crashes

Error Output

TypeError: Cannot read properties of undefined (reading 'prototype')
    at 33789 (.../node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:2:496047)
    at __webpack_require__ (.../lib/index.js:20:3126116)
    at 26161 (.../lib/index.js:2:931210)
    at __webpack_require__ (.../lib/index.js:20:3126116)
    at 6842  (.../lib/index.js:2:937880)
    at __webpack_require__ (.../lib/index.js:20:3126116)
    at 15238 (.../lib/index.js:2:936303)
    at __webpack_require__ (.../lib/index.js:20:3126116)
    at 27664 (.../lib/index.js:2:913084)
    at __webpack_require__ (.../lib/index.js:20:3126116)

Verification

# Confirm SlowBuffer is gone in Node 25:
node -e "console.log(typeof require('buffer').SlowBuffer)"
# Output: undefined

Suggested Fixes

Both affected packages need updates, then the webpack bundle needs to be rebuilt:

Package	Fix
buffer-equal-constant-time	Replace with crypto.timingSafeEqual (built-in since Node 6)
iconv-lite	Update to v0.6+ which guards SlowBuffer access, or use Node built-in TextDecoder/TextEncoder

Quick interim fix — add a shim at the webpack bundle entry point:

const buffer = require('buffer');
if (!buffer.SlowBuffer) {
  buffer.SlowBuffer = buffer.Buffer; // minimal polyfill
}

Environment

Item	Value
Node.js	v25.6.1
OS	macOS Darwin 25.3.0 arm64
@microsoft/m365agentstoolkit-cli	1.1.4
@microsoft/teamsapp-cli	3.0.10

Workaround

• Use Node.js 20 LTS (e.g. nvm use 20) for CLI commands
• The Teams Toolkit VS Code extension is unaffected — it uses its own bundled Node runtime

[m365-agent-toolkit-assistant]

👋 Hi @VikrantSingh01,

Thank you for reporting this issue! We want to let you know that:

⏱️ Our team will personally review your issue
🎯 You can expect a response within 2 business days

✨ This is an AI-generated initial response
🤖 AI-Generated Preliminary Analysis:

This issue—teamsapp CLI crashing on Node.js v25 with TypeError: Cannot read properties of undefined (reading 'prototype')—is a known incompatibility. The root cause is breaking changes in Node.js 25 internals that affect the Teams Toolkit CLI’s webpack-bundled code. All CLI commands will fail with this error on Node 25.x.

Workaround:
Downgrade to Node.js v22.x or v20.x (LTS). Use nvm or a similar tool:

nvm install 22
nvm use 22

The Microsoft 365 Agents Toolkit team is tracking this incompatibility—they plan to add Node 25 support in a future release.

References:

• GitHub Issue #15113

Summary:

• Use Node 20.x or 22.x with the CLI.
• Node 25 is not yet supported.
• Teams Toolkit VS Code extension is unaffected.

Sorry for the inconvenience! Watch the linked issue for updates.

✨We'd love your feedback! Please take a moment to fill out our survey.

---

Note: This is an automated first response generated by AI. A human team member will review your issue and provide a more detailed response soon. We appreciate your patience!

[VikrantSingh01]

Root Cause

SlowBuffer was removed in Node.js v25 (nodejs/node#56601). The bundled buffer-equal-constant-time package accesses SlowBuffer.prototype.equal at module load time, which crashes because SlowBuffer is undefined.

The crash site in the webpack bundle:

// from buffer-equal-constant-time
var origSlowBufEqual = SlowBuffer.prototype.equal;
//                     ^^^^^^^^^^^ undefined in Node 25

Suggested Fix

Replace the dependency on buffer-equal-constant-time with Node's built-in crypto.timingSafeEqual (available since Node 6), or guard the SlowBuffer access:

// Option 1: Use built-in (preferred)
const { timingSafeEqual } = require('crypto');

// Option 2: Guard the polyfill
const SlowBuffer = require('buffer').SlowBuffer;
if (SlowBuffer) {
  // ... existing monkey-patching
}

This needs a rebuild of the webpack bundle since lib/index.js is a pre-built artifact.

[summzhan]

@VikrantSingh01, Teamsapp CLI is deprecated last year at May. It's now in maintenance mode, we will see and fix the issue but you are recommended to use ATK CLI instead. Because the teamsapp CLI will not be supported by around June.

[VikrantSingh01]

The new @microsoft/m365agentstoolkit-cli@1.1.4 (atk binary) has the same crash — identical SlowBuffer.prototype error at module ID 33789. Both CLI packages share the same bundled buffer-equal-constant-time dependency.

[VikrantSingh01]

Complete Crash Dump

System Info

Node.js: v25.6.1
npm:     11.9.0
OS:      Darwin 25.3.0 arm64
Shell:   /bin/zsh
@microsoft/m365agentstoolkit-cli: 1.1.4

SlowBuffer Verification

$ node -e "const b = require('buffer'); console.log('SlowBuffer type:', typeof b.SlowBuffer); console.log('SlowBuffer in buffer:', 'SlowBuffer' in b);"
SlowBuffer type: undefined
SlowBuffer in buffer: false

Crash Output (npx atk --version)

TypeError: Cannot read properties of undefined (reading 'prototype')
    at 33789 (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:2:496047)
    at __webpack_require__ (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:20:3126116)
    at 26161 (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:2:931210)
    at __webpack_require__ (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:20:3126116)
    at 6842 (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:2:937880)
    at __webpack_require__ (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:20:3126116)
    at 15238 (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:2:936303)
    at __webpack_require__ (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:20:3126116)
    at 27664 (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:2:913084)
    at __webpack_require__ (/Users/vikrant/Projects/voice-trainer/node_modules/@microsoft/m365agentstoolkit-cli/lib/index.js:20:3126116)

Webpack Module Require Chain (decoded)

Module 27664   (entry)
  └── Module 15238
        └── Module 6842
              └── Module 26161
                    └── Module 33789  ← buffer-equal-constant-time (CRASH)
                          └── Module 20181  ← Node buffer polyfill (SlowBuffer = undefined)

Crash Site in Bundle

Offset 496047 in lib/index.js (module 33789 = buffer-equal-constant-time):

var Buffer = __webpack_require__(20181).Buffer,
    SlowBuffer = __webpack_require__(20181).SlowBuffer;
// SlowBuffer is undefined in Node 25

function bufferEq(a, b) { /* ... */ }

bufferEq.install = function () {
  Buffer.prototype.equal = SlowBuffer.prototype.equal = function equal(that) {
    //                      ^^^^^^^^^^^^^^^^^^^^^^^^ TypeError: Cannot read properties of undefined
    return bufferEq(this, that);
  };
};

var origBufEqual = Buffer.prototype.equal,
    origSlowBufEqual = SlowBuffer.prototype.equal;  // ← CRASHES HERE
//                     ^^^^^^^^^^^^^^^^^^^^^^^^

Second Crash Site (hidden, masked by first crash)

Module 81542 (iconv-lite) at offset 886892:

var SlowBuffer = __webpack_require__(20181).SlowBuffer;  // undefined
if (
  original.SlowBufferToString = SlowBuffer.prototype.toString,  // ← WOULD CRASH
  SlowBuffer.prototype.toString = function(encoding, start, end) { /* ... */ }
) // ...

All 25 SlowBuffer References in Bundle

#	Offset	Module	Package	Accesses .prototype?
1-5	495675–496189	33789	buffer-equal-constant-time	Yes — CRASHES
6-16	886831–888230	81542	iconv-lite (extend)	Yes — would crash
17-22	890212–890358	81542	iconv-lite (restore)	Yes — would crash
23	1185619	7475	safer-buffer	No (constructor call)
24-25	1185831, 8477155	7475	safer-buffer	No (string comparison)

[tecton]

Hi @VikrantSingh01, thanks for raising this issue. CLI has not supported NodeJS v25 now as you have listed that dependencies uses SlowBuffer which is removed in v25. The latest version of dependencies have not fixed this yet so to make it compatible with v25 we need to fix in webpack bundling.
We have tested on v22 so you could use v22 or v24 for now and we'll start to support v25 soon.

[tecton]

CLI will be compatible in v25 in next stable version.