CVE-2025-29774
1 advisory.
npm/xml-crypto CVE-2025-29774: critical
xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
Action: Upgrade xml-crypto to 2.1.6 or later.
npm i xml-crypto@6.0.1npm i xml-crypto@3.2.1npm i xml-crypto@2.1.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 6.0.1 | - |
| 3.0.0 | 3.2.1 | - |
| 0 | 2.1.6 | - |
Fixed versions
| 6.0.1 | 3.2.1 | 2.1.6 |
Sources
- osv: GHSA-9p8x-f768-wp2g
- https://github.com/node-saml/xml-crypto/security/advisories/GHSA-9p8x-f768-wp2g
- https://nvd.nist.gov/vuln/detail/CVE-2025-29774
- https://github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed
- https://github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98
- https://github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07
- https://github.com/node-saml/xml-crypto
- https://github.com/node-saml/xml-crypto/releases/tag/v2.1.6
- https://github.com/node-saml/xml-crypto/releases/tag/v3.2.1
- https://github.com/node-saml/xml-crypto/releases/tag/v6.0.1
- https://workos.com/blog/samlstorm
CVE-2025-29774 · published · modified · JSON