{"action":"Upgrade thinbus-srp to 2.0.1 or later.","affected":[{"fixed":"2.0.1","introduced":"0"}],"component":"thinbus-srp","cve_ids":["CVE-2025-54885"],"ecosystem":"npm","epss":0.00385,"exploited":false,"fixed_versions":["2.0.1"],"ghsa_id":"GHSA-8q6v-474h-whgg","id":"tcs_01M5KFDQPZKPXDDW4NE2WYZK71","modified_at":"2025-08-07T15:11:48Z","published_at":"2025-08-06T17:11:42Z","references":["https://osv.dev/vulnerability/GHSA-8q6v-474h-whgg","https://github.com/simbo1905/thinbus-srp-npm/security/advisories/GHSA-8q6v-474h-whgg","https://nvd.nist.gov/vuln/detail/CVE-2025-54885","https://github.com/simbo1905/thinbus-srp-npm/issues/28","https://github.com/simbo1905/thinbus-srp-npm/pull/30/commits/4aeaea2366e090765a8204059c7bcf3616438d31","https://github.com/simbo1905/thinbus-srp-npm/commit/aa7064c1db7294ce867e9bc92f26fa6c71a5a2cb","https://github.com/simbo1905/thinbus-srp-npm"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-8q6v-474h-whgg","url":"https://osv.dev/vulnerability/GHSA-8q6v-474h-whgg"},{"source":"nvd","source_id":"CVE-2025-54885","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54885"}],"summary":"The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended"}