p PatchFirst

CVE-2025-65849

CVE-2025-65849

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is "to discourage automated scraping / bots, not guarantee resistance to determined attackers." The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”

CVSS 9.1 · Critical · EPSS 0.2%

Published
Updated

Stack: node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • altcha npm

    Affected ranges
    • SEMVER: ≥ 0.8.0, ≤ 2.2.4

    No fix published

Original sources

Check your server →