CVE-2025-6545
1 advisory.
npm/pbkdf2 CVE-2025-6545: critical
pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos
Action: Upgrade pbkdf2 to 3.1.3 or later.
npm i pbkdf2@3.1.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.10 | 3.1.3 | - |
Fixed versions
| 3.1.3 |
Sources
- osv: GHSA-h7cp-r72f-jxh6
- https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6
- https://nvd.nist.gov/vuln/detail/CVE-2025-6545
- https://github.com/browserify/pbkdf2/commit/9699045c37a07f8319cfb8d44e2ff4252d7a7078
- https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb
- https://github.com/browserify/pbkdf2
CVE-2025-6545 · published · modified · JSON