CVE-2025-6545CWE-20

pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

Critical · published June 23, 2025

CVSS v4.0
9.1
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js.

This issue affects pbkdf2: from 3.0.10 through 3.1.2.

The record
Technical detail
CVSS v4.0
9.1 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H
EPSS
0.00447 · 37.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-06-23T18:41Z
EPSS history
Timeline
  • 23 JUN 18:41Z
    pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js
    cvelistv5