p PatchFirst

CVE-2025-9288

CVE-2025-9288 · Missing type checks leading to hash rewind and passing on crafted data

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

CVSS 9.1 · Critical · EPSS 0.7% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node-sha.js Debian:12

    Versions
    • 2.4.11+~2.4.0-2
    Affected ranges
    • ECOSYSTEM: < 2.4.11+~2.4.0-2+deb12u1

    Update to 2.4.11+~2.4.0-2+deb12u1

  • node-sha.js Debian:13

    Versions
    • 2.4.11+~2.4.0-2
    Affected ranges
    • ECOSYSTEM: < 2.4.11+~2.4.0-2+deb13u1

    Update to 2.4.11+~2.4.0-2+deb13u1

  • node-sha.js Debian:14

    Versions
    • 2.4.11+~2.4.0-2
    Affected ranges
    • ECOSYSTEM: < 2.4.12+~3.0.5-1

    Update to 2.4.12+~3.0.5-1

  • sha.js npm

    Affected ranges
    • SEMVER: < 2.4.12

    Update to 2.4.12

  • node-sha.js Ubuntu:Pro:18.04:LTS

    Versions
    • 2.4.8-1
    • 2.4.9-1
    Affected ranges
    • ECOSYSTEM: < 2.4.9-1ubuntu0.1~esm1

    Update to 2.4.9-1ubuntu0.1~esm1

  • node-sha.js Ubuntu:Pro:20.04:LTS

    Versions
    • 2.4.11-2
    Affected ranges
    • ECOSYSTEM: < 2.4.11-2ubuntu0.1~esm1

    Update to 2.4.11-2ubuntu0.1~esm1

  • node-sha.js Ubuntu:22.04:LTS

    Versions
    • 2.4.11-2
    • 2.4.11+~2.4.0-1
    Affected ranges
    • ECOSYSTEM: < 2.4.11+~2.4.0-1ubuntu0.1

    Update to 2.4.11+~2.4.0-1ubuntu0.1

  • node-sha.js Ubuntu:24.04:LTS

    Versions
    • 2.4.11+~2.4.0-2
    Affected ranges
    • ECOSYSTEM: < 2.4.11+~2.4.0-2+deb13u1build0.24.04.1

    Update to 2.4.11+~2.4.0-2+deb13u1build0.24.04.1

Original sources

Check your server →