CVE-2025-6547
CVE-2025-6547 · On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.
CVSS 9.1 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
pbkdf2 npm
- Affected ranges
- SEMVER: ≥ 1.0.0, < 3.1.3
Update to 3.1.3