CVE Details
Basic Information
| Title | On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys |
|---|---|
| Type | cve |
| Published | 2025-06-23T19:00:45.472Z |
| Last Seen |
Product Information
| Vendor | |
|---|---|
| Product | |
| Version | <=3.1.2 |
CVSS Information
| Base Score | 9.1 (CRITICAL) |
|---|---|
| Attack Vector | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H |
| Confidentiality Impact | |
| Integrity Impact | |
| Availability Impact |
AI Analysis
| AI Description | An improper input validation vulnerability in the pbkdf2 library allows signature spoofing by improperly validating inputs. This issue affects versions of pbkdf2 less than or equal to 3.1.2. The vulnerability occurs because pbkdf2 silently disregards Uint8Array input, leading to the generation of static keys. This can have significant security implications for applications relying on this library for secure key generation. |
|---|---|
| AI Severity | Critical |
| Vendor | Node.js Foundation |
| Product | pbkdf2 |
| Affected Version | <=3.1.2 |
Affected Products
- <=3.1.2
Additional Information
| CVE List | |
|---|---|
| CWE List | CWE-20 |
| Bulletin Family |
References
Description
Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This issue affects pbkdf2: <=3.1.2.