Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2025-6547

On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
harborist

Description

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pbkdf2

Default version status: unaffected

  • >= 1 <=3.1.2affected

References