{"action":"Upgrade pbkdf2 to 3.1.3 or later.","affected":[{"fixed":"3.1.3","introduced":"3.0.10"}],"component":"pbkdf2","cve_ids":["CVE-2025-6545"],"ecosystem":"npm","epss":0.00447,"exploited":false,"fixed_versions":["3.1.3"],"ghsa_id":"GHSA-h7cp-r72f-jxh6","id":"tcs_01M5KFTEHRTYM1160GTYAXZ0NM","modified_at":"2026-09-10T03:50:25.355803074Z","published_at":"2025-06-23T22:41:50Z","references":["https://osv.dev/vulnerability/GHSA-h7cp-r72f-jxh6","https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6","https://nvd.nist.gov/vuln/detail/CVE-2025-6545","https://github.com/browserify/pbkdf2/commit/9699045c37a07f8319cfb8d44e2ff4252d7a7078","https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb","https://github.com/browserify/pbkdf2"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-h7cp-r72f-jxh6","url":"https://osv.dev/vulnerability/GHSA-h7cp-r72f-jxh6"}],"summary":"pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos"}