{"action":"Upgrade sha.js to 2.4.12 or later.","affected":[{"fixed":"2.4.12","introduced":"0"}],"component":"sha.js","cve_ids":["CVE-2025-9288"],"ecosystem":"npm","epss":0.00738,"exploited":false,"fixed_versions":["2.4.12"],"ghsa_id":"GHSA-95m3-7q98-8xr5","id":"tcs_01M5KFEX1JQPHY56KQ3YZBM9NC","modified_at":"2026-09-10T03:50:26.795456685Z","published_at":"2025-08-21T14:47:55Z","references":["https://osv.dev/vulnerability/GHSA-95m3-7q98-8xr5","https://github.com/browserify/sha.js/security/advisories/GHSA-95m3-7q98-8xr5","https://nvd.nist.gov/vuln/detail/CVE-2025-9288","https://github.com/browserify/sha.js/pull/78","https://github.com/browserify/sha.js/commit/f2a258e9f2d0fcd113bfbaa49706e1ac0d979ba5","https://github.com/browserify/sha.js","https://lists.debian.org/debian-lts-announce/2025/09/msg00016.html","https://www.cve.org/CVERecord?id=CVE-2025-9287"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-95m3-7q98-8xr5","url":"https://osv.dev/vulnerability/GHSA-95m3-7q98-8xr5"}],"summary":"sha.js is missing type checks leading to hash rewind and passing on crafted data"}