{"action":"Upgrade xml-crypto to 2.1.6 or later.","affected":[{"fixed":"6.0.1","introduced":"4.0.0"},{"fixed":"3.2.1","introduced":"3.0.0"},{"fixed":"2.1.6","introduced":"0"}],"component":"xml-crypto","cve_ids":["CVE-2025-29774"],"ecosystem":"npm","epss":0.09103,"exploited":false,"fixed_versions":["6.0.1","3.2.1","2.1.6"],"ghsa_id":"GHSA-9p8x-f768-wp2g","id":"tcs_01M5KFGER0Z061WGMJ3W9AX3X2","modified_at":"2026-09-10T03:49:48.483681113Z","published_at":"2025-03-14T17:14:23Z","references":["https://osv.dev/vulnerability/GHSA-9p8x-f768-wp2g","https://github.com/node-saml/xml-crypto/security/advisories/GHSA-9p8x-f768-wp2g","https://nvd.nist.gov/vuln/detail/CVE-2025-29774","https://github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed","https://github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98","https://github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07","https://github.com/node-saml/xml-crypto","https://github.com/node-saml/xml-crypto/releases/tag/v2.1.6","https://github.com/node-saml/xml-crypto/releases/tag/v3.2.1","https://github.com/node-saml/xml-crypto/releases/tag/v6.0.1","https://workos.com/blog/samlstorm"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-9p8x-f768-wp2g","url":"https://osv.dev/vulnerability/GHSA-9p8x-f768-wp2g"},{"source":"nvd","source_id":"CVE-2025-29774","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29774"}],"summary":"xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References"}