{"id":7187,"date":"2025-06-23T14:34:41","date_gmt":"2025-06-23T14:34:41","guid":{"rendered":"http:\/\/localhost\/?p=7187"},"modified":"2025-06-23T14:34:41","modified_gmt":"2025-06-23T14:34:41","slug":"on-nodejs-3-pbkdf2-silently-disregards-uint8array-input-returning-static-keys","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=7187","title":{"rendered":"On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys"},"content":{"rendered":"
\n

CVE Details<\/h2>\n
\n
\n

Basic Information<\/h3>\n\n\n\n\n\n
Title<\/th>\nOn Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys<\/td>\n<\/tr>\n
Type<\/th>\ncve<\/td>\n<\/tr>\n
Published<\/th>\n2025-06-23T19:00:45.472Z<\/td>\n<\/tr>\n
Last Seen<\/th>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

Product Information<\/h3>\n\n\n\n\n
Vendor<\/th>\n<\/td>\n<\/tr>\n
Product<\/th>\n<\/td>\n<\/tr>\n
Version<\/th>\n<=3.1.2<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
\n

CVSS Information<\/h3>\n\n\n\n\n\n\n
Base Score<\/th>\n9.1 (CRITICAL)<\/td>\n<\/tr>\n
Attack Vector<\/th>\nCVSS:4.0\/AV:N\/AC:H\/AT:P\/PR:N\/UI:N\/VC:N\/VI:H\/VA:N\/SC:H\/SI:H\/SA:H<\/td>\n<\/tr>\n
Confidentiality Impact<\/th>\n<\/td>\n<\/tr>\n
Integrity Impact<\/th>\n<\/td>\n<\/tr>\n
Availability Impact<\/th>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

AI Analysis<\/h3>\n\n\n\n\n\n\n
AI Description<\/th>\nAn improper input validation vulnerability in the pbkdf2 library allows signature spoofing by improperly validating inputs. This issue affects versions of pbkdf2 less than or equal to 3.1.2. The vulnerability occurs because pbkdf2 silently disregards Uint8Array input, leading to the generation of static keys. This can have significant security implications for applications relying on this library for secure key generation.<\/td>\n<\/tr>\n
AI Severity<\/th>\nCritical<\/td>\n<\/tr>\n
Vendor<\/th>\nNode.js Foundation<\/td>\n<\/tr>\n
Product<\/th>\npbkdf2<\/td>\n<\/tr>\n
Affected Version<\/th>\n<=3.1.2<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

Affected Products<\/h4>\n