From 3dae6c38ca5137e4f6bd167a7b0bdd1a67871d63 Mon Sep 17 00:00:00 2001
From: Burak Keskin <official.burak@icloud.com>
Date: Wed, 2 Sep 2026 13:30:03 +0300
Subject: [PATCH] fix: reject non-integer genSalt costs

Fractional costs were written into the salt with toString, so 10.5
became $2b$10.5$ and hashSync failed with Missing salt rounds.

Fixes #173
---
 index.js       |  2 ++
 tests/index.js | 14 ++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/index.js b/index.js
index 4a19b3d..6296b98 100644
--- a/index.js
+++ b/index.js
@@ -90,6 +90,8 @@ export function genSaltSync(rounds, seed_length) {
     throw Error(
       "Illegal arguments: " + typeof rounds + ", " + typeof seed_length,
     );
+  if (!Number.isInteger(rounds))
+    throw Error("Illegal arguments: rounds must be an integer");
   if (rounds < 4) rounds = 4;
   else if (rounds > 31) rounds = 31;
   var salt = [];
diff --git a/tests/index.js b/tests/index.js
index 525a44d..2cf2836 100644
--- a/tests/index.js
+++ b/tests/index.js
@@ -35,6 +35,20 @@ const tests = [
     assert(salt.length > 0);
     done();
   },
+  function genSaltSyncIntegerRounds(done) {
+    var salt = bcrypt.genSaltSync(10);
+    assert.strictEqual(salt.substring(0, 7), "$2b$10$");
+    assert.doesNotThrow(function () {
+      bcrypt.hashSync("hello", salt);
+    });
+    assert.throws(function () {
+      bcrypt.genSaltSync(10.5);
+    });
+    assert.throws(function () {
+      bcrypt.hashSync("hello", 10.5);
+    });
+    done();
+  },
   function genSalt(done) {
     bcrypt.genSalt(10, function (err, salt) {
       assert(!err);