CVE-2025-6547
1 advisory.
npm/pbkdf2 CVE-2025-6547: critical, EPSS 0.46%
pbkdf2 silently disregards Uint8Array input, returning static keys
Action: Upgrade pbkdf2 to 3.1.3 or later.
npm i pbkdf2@3.1.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 3.1.3 | - |
Fixed versions
| 3.1.3 |
Sources
- osv: GHSA-v62p-rq8g-8h59
- https://github.com/browserify/pbkdf2/security/advisories/GHSA-v62p-rq8g-8h59
- https://nvd.nist.gov/vuln/detail/CVE-2025-6547
- https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb
- https://github.com/browserify/pbkdf2
CVE-2025-6547 · published · modified · JSON