p PatchFirst

CVE-2025-6545

CVE-2025-6545 · pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

CVSS 9.1 · Critical · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node-pbkdf2 Debian:12

    Versions
    • 3.1.2-3
    • 3.1.3+~3.1.2-1
    • 3.1.5+~3.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-pbkdf2 Debian:13

    Versions
    • 3.1.2-3
    • 3.1.3+~3.1.2-1
    • 3.1.5+~3.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-pbkdf2 Debian:14

    Versions
    • 3.1.2-3
    Affected ranges
    • ECOSYSTEM: < 3.1.3+~3.1.2-1

    Update to 3.1.3+~3.1.2-1

  • pbkdf2 npm

    Affected ranges
    • SEMVER: ≥ 3.0.10, < 3.1.3

    Update to 3.1.3

  • node-pbkdf2 Ubuntu:Pro:18.04:LTS

    Versions
    • 3.0.13-1
    • 3.0.14-1
    • 3.0.14-2
    Affected ranges
    • ECOSYSTEM: < 3.0.14-2ubuntu0.1~esm1

    Update to 3.0.14-2ubuntu0.1~esm1

  • node-pbkdf2 Ubuntu:Pro:20.04:LTS

    Versions
    • 3.0.16-1
    Affected ranges
    • ECOSYSTEM: < 3.0.16-1ubuntu0.1~esm1

    Update to 3.0.16-1ubuntu0.1~esm1

  • node-pbkdf2 Ubuntu:Pro:22.04:LTS

    Versions
    • 3.0.16-1
    • 3.1.2-2
    Affected ranges
    • ECOSYSTEM: < 3.1.2-2ubuntu0.1~esm1

    Update to 3.1.2-2ubuntu0.1~esm1

  • node-pbkdf2 Ubuntu:Pro:24.04:LTS

    Versions
    • 3.1.2-3
    Affected ranges
    • ECOSYSTEM: < 3.1.2-3ubuntu0.1~esm1

    Update to 3.1.2-3ubuntu0.1~esm1

Original sources

Check your server →