Read the docs
TI-2025-20420 Aliases CVE-2025-27611GHSA-xq7p-g2vc-g82p

base-x homograph attack allows Unicode lookalike characters to bypass validation.

Priority LOW 38CWE-1007Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00449 39th percentileScored 2026-11-07
Fix Fixed base-x (cryptocoinjs): 3.0.11base-x (npm): 5.0.1, 4.0.1, 3.0.11Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cryptocoinjsbase-x= 5.0.0; = 4.0.0; before 3.0.113.0.11Patch availableCNA
—base-x (npm)5.0.0 to before 5.0.15.0.1Patch availableGHSA-xq7p-g2vc-g82p
—base-x (npm)4.0.0 to before 4.0.14.0.1Patch availableGHSA-xq7p-g2vc-g82p
—base-x (npm)before 3.0.113.0.11Patch availableGHSA-xq7p-g2vc-g82p
  • base-x Vendorcryptocoinjs Affected = 5.0.0; = 4.0.0; before 3.0.11 Fixed in 3.0.11 Patch available CNA
  • base-x (npm) Vendor— Affected 5.0.0 to before 5.0.1 Fixed in 5.0.1 Patch available GHSA-xq7p-g2vc-g82p
  • base-x (npm) Vendor— Affected 4.0.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-xq7p-g2vc-g82p
  • base-x (npm) Vendor— Affected before 3.0.11 Fixed in 3.0.11 Patch available GHSA-xq7p-g2vc-g82p

Remediation

  • Fix · CNA base-x (cryptocoinjs) Fixed in 3.0.11
  • Fix · GHSA-xq7p-g2vc-g82p base-x (npm) Fixed in 5.0.1 Advisory →
  • Fix · GHSA-xq7p-g2vc-g82p base-x (npm) Fixed in 4.0.1 Advisory →
  • Fix · GHSA-xq7p-g2vc-g82p base-x (npm) Fixed in 3.0.11 Advisory →

Red Hat 3 advisories

  • RHSA-2025:10459 Released 2025-07-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.8 Security update
    • Red Hat JBoss Enterprise Application Platform 8.0.8
  • RHSA-2025:10452 Released 2025-07-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.8 Security update
    • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-activemq-artemis-2.33.0-3.redhat_00017.1.el8eap, eap8-activemq-artemis-cli-2.33.0-3.redhat_00017.1.el8eap, eap8-activemq-artemis-commons-2.33.0-3.redhat_00017.1.el8eap +47
  • RHSA-2025:10453 Released 2025-07-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.8 Security update
    • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-activemq-artemis-2.33.0-3.redhat_00017.1.el9eap, eap8-activemq-artemis-cli-2.33.0-3.redhat_00017.1.el9eap, eap8-activemq-artemis-commons-2.33.0-3.redhat_00017.1.el9eap +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss EAP 8.0 for RHEL 8Fixed RHSA-2025:10452
Red Hat JBoss EAP 8.0 for RHEL 9Fixed RHSA-2025:10453
Red Hat JBoss Enterprise Application Platform 8.0.8Fixed RHSA-2025:10459
Not affected: 1 product
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27611
  2. 2026-10-03 Alias added: GHSA-xq7p-g2vc-g82p

References

Advisory 1

Other 3

  • TI-2024-32625 secp256k1-node vulnerable to private key extraction over ECDH CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences