Cryptpad fails with JS "TypeError: Utils.Util.decodeUTF8 is not a function"

[chmeyer]

What app is this about, and its version: Cryptpad v2025.9.0 and v2026.2.0 (2025.9.0~ynh1 and 2026.29.0~ynh1)
What YunoHost version are you running: 12.1.39 (stable)
What type of hardware are you using: VPS bought online

Describe your issue

Hello there,
I’m having problems with Cryptpad. I’m logged in as Ynh-User and want to access my previous stored files.
When I click on Drive (or Documents, Presentation or whatever), it starts loading, but then fails with the error message “TypeError: Utils.Util.decodeUTF8 is not a function” (visible in the main browser window)

When I type “Utils.Util.decodeUTF8” in JS-browser-console (F12) it says: ReferenceError: Utils is not defined.

So I started grepping for “Utils.Util.decodeUTF8” in /var/www/cryptpad/*, but it didn’t find a single match.

Then I found /var/www/cryptpad/node_modules/popper.js/dist/umd/popper.js, and it says:

     * Starting from version 1.7, this method is available only if you
     * include `popper-utils.js` before `popper.js`.
     *
     * **DEPRECATION**: This way to access PopperUtils is deprecated
     * and will be removed in v2! Use the PopperUtils module directly instead.
     * Due to the high instability of the methods contained in Utils, we can't
     * guarantee them to follow semver. Use them at your own risk!

But there is a second possibility: nacl.util.decodeUTF8 is mentioned in /var/www/cryptpad/node_modules/tweetnacl-util/README.md and it is called some times in various files in Cryptpad directory.

So I also found this topic: Cryptpad hangs on loading (uncaught typeerror) with Uncaught TypeError: Util.getVersionFromUrlArgs, and I think, it could be related.

After that (,a reboot and a system upgrade) I updated to 2026.2.0, but the problem still persists. Maybe, the real problem is caused by upgrades from a previous CryptPad update, because the initial installation was done some years ago.

Thank you for any hints or ideas!

Christian Meyer

Share relevant logs or error messages

[chmeyer]

Some investigation showed, that as an anonymous user, most document types work as expected, only Sheet, Document and Presentation creates such an error-message.
Login in via cryptpad page leads to this error, too.

When logged in via YNH-SSO then all documents fail.

Pressing F12 in Firefox reveals a hint, but I don’t know what it really means and how to fix it:
Maybe it’s a cryptpad sandbox issue?

Shortly before the “Uncaught TypeError: Utils.Util.decodeUTF8 is not a function”, there is an error about Content-Security-Policy, saying there is a settings problem for this site and ‘unsafe-eval’ is missing in sframe-boot.js:

Content-Security-Policy: Die Einstellungen der Seite haben die Ausführung eines JavaScript-Evals (script-src) blockiert, da es gegen folgende Direktive verstößt: “script-src ‘self’ resource: https://cryptpad.my.domain” (es fehlt ‘unsafe-eval’) sframe-boot.js:48:5