p PatchFirst

CVE-2025-9287

CVE-2025-9287 · Missing type checks leading to hash rewind and passing on crafted data

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.

CVSS 9.1 · Critical · EPSS 0.5% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node-cipher-base Debian:12

    Versions
    • 1.0.4-6
    Affected ranges
    • ECOSYSTEM: < 1.0.4-6+deb12u1

    Update to 1.0.4-6+deb12u1

  • node-cipher-base Debian:13

    Versions
    • 1.0.4-6
    Affected ranges
    • ECOSYSTEM: < 1.0.4-6+deb13u1

    Update to 1.0.4-6+deb13u1

  • node-cipher-base Debian:14

    Versions
    • 1.0.4-6
    Affected ranges
    • ECOSYSTEM: < 1.0.6-1

    Update to 1.0.6-1

  • cipher-base npm

    Affected ranges
    • SEMVER: < 1.0.5

    Update to 1.0.5

  • node-cipher-base Ubuntu:Pro:18.04:LTS

    Versions
    • 1.0.4-1
    Affected ranges
    • ECOSYSTEM: < 1.0.4-1ubuntu0.1~esm2

    Update to 1.0.4-1ubuntu0.1~esm2

  • node-cipher-base Ubuntu:Pro:20.04:LTS

    Versions
    • 1.0.4-4
    Affected ranges
    • ECOSYSTEM: < 1.0.4-4ubuntu0.1~esm2

    Update to 1.0.4-4ubuntu0.1~esm2

  • node-cipher-base Ubuntu:22.04:LTS

    Versions
    • 1.0.4-4
    • 1.0.4-5
    • 1.0.4-6
    Affected ranges
    • ECOSYSTEM: < 1.0.4-6+deb13u1ubuntu0.22.04.1

    Update to 1.0.4-6+deb13u1ubuntu0.22.04.1

  • node-cipher-base Ubuntu:24.04:LTS

    Versions
    • 1.0.4-6
    Affected ranges
    • ECOSYSTEM: < 1.0.4-6+deb13u1ubuntu0.24.04.1

    Update to 1.0.4-6+deb13u1ubuntu0.24.04.1

Original sources

Check your server →