`node:crypto` createPublicKey rejects DER SPKI accepted by Node.js

[kevgeoleo]

What version of Bun is running?

1.3.13-canary.1+1b93e94b2

What platform is your computer?

Linux 5.10.0-12-amd64 x86_64 x86_64

What steps can reproduce the bug?

Hi,

I would like to report a behavior in Bun that can be reproduced using the below snippet:

import { createPublicKey } from 'node:crypto';

const key = createPublicKey({
  key: Buffer.from(
    'MDswDQYJKoZIhvcNAQEBBQADKgAwJwIg3wUvyMOfq7G6dT5bIM6keoShd9YGwP7PIc2Tfa8Q99ECAwEAAQ==',
    'base64'
  ),
  format: 'der',
  type: 'spki',
});

console.log(key);

What is the expected behavior?

root@KContainer:~/8004# node b.mjs
PublicKeyObject { Symbol(kKeyType): 'public' }

What do you see instead?

root@KContainer:~/8004# bun run b.mjs
1 | import { createPublicKey } from 'node:crypto';
2 |
3 | const key = createPublicKey({
                ^
error: Failed to read asymmetric key
      at /home/c01kele/8004/b.mjs:3:13
      at loadAndEvaluateModule (2:1)

Bun v1.3.13-canary.1+1b93e94b2 (Linux x64)

Additional information

No response

[github-actions]

Found 2 possible duplicate issues:

1. TypeError with Crypto's createPublicKey fn #8004
2. Crypto different in node and bun #13979

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[robobun]

✅ Reproduced — the 256-bit RSA modulus in that SPKI starts with 0xDF but is missing the leading 0x00 sign byte, so BoringSSL rejects it with BN_R_NEGATIVE_NUMBER. OpenSSL (Node) treats it as unsigned. Fix adds a loose SPKI parser that BoringSSL falls back to on that specific error → #29561