From 219db32fdf3c78089c97ccac377c08697443fa0e Mon Sep 17 00:00:00 2001
From: Yash Singh <123385188+yashs33244@users.noreply.github.com>
Date: Mon, 22 Jun 2026 09:05:37 +0530
Subject: [PATCH] fix: only send S3 checksums when required to support
 S3-compatible storage (#2984)

---
 packages/lib/universal/upload/providers/s3-provider.ts | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/packages/lib/universal/upload/providers/s3-provider.ts b/packages/lib/universal/upload/providers/s3-provider.ts
index 2aa73cf9f..c98f2b2c4 100644
--- a/packages/lib/universal/upload/providers/s3-provider.ts
+++ b/packages/lib/universal/upload/providers/s3-provider.ts
@@ -17,6 +17,14 @@ export class S3Provider implements StorageProvider {
       endpoint: env('NEXT_PRIVATE_UPLOAD_ENDPOINT') || undefined,
       forcePathStyle: env('NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE') === 'true',
       region: env('NEXT_PRIVATE_UPLOAD_REGION') || 'us-east-1',
+      // Since v3.729 the AWS SDK adds a CRC32 checksum to every request by default
+      // (`requestChecksumCalculation: 'WHEN_SUPPORTED'`). Many S3-compatible providers
+      // (GarageHQ, MinIO, Backblaze B2, etc.) reject those requests with an
+      // `InvalidDigest` error, which breaks uploads against third-party storage. Only
+      // send/validate checksums when the operation actually requires them so the default
+      // configuration keeps working with non-AWS backends.
+      requestChecksumCalculation: 'WHEN_REQUIRED',
+      responseChecksumValidation: 'WHEN_REQUIRED',
       credentials: hasCredentials
         ? {
             accessKeyId: String(env('NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID')),