CVE-2025-6547CWE-20

On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys

Critical · published June 23, 2025

CVSS v4.0
9.1
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

The record
Technical detail
CVSS v4.0
9.1 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
EPSS
0.00463 · 39.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-06-23T19:00Z
EPSS history
Timeline
  • 23 JUN 19:00Z
    On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys
    cvelistv5