DeprecationWarning: Buffer() is deprecated due to security and usability issues

What causes this error

The old new Buffer(arg) constructor overloaded its behavior based on the argument's type in ways that were easy to misuse — passing a number allocated uninitialized memory that could leak sensitive data from other parts of the process if not immediately overwritten. Node deprecated the constructor entirely in favor of explicit factory methods.

The Fix

// Wrong — deprecated, ambiguous behavior
const buf = new Buffer(size);

// Fix — pick the explicit factory that matches your intent
Buffer.from('hello');           // from a string
Buffer.from([1, 2, 3]);         // from an array of bytes
Buffer.alloc(10);                // 10 zero-filled bytes (safe)
Buffer.allocUnsafe(10);           // 10 uninitialized bytes (fast, but fill it immediately)

Common causes / variations

• Old code or an outdated dependency still using the legacy constructor
• Copy-pasted Buffer examples from pre-2016 tutorials
• Using `allocUnsafe` where `alloc` was actually intended, leaving stale memory content in the buffer

Related errors

See also: crypto.randomUUID is not a function.