Vulnerabilities

TI-2026-65391 CVE-2026-102414 · GHSA-477h-4r7f-fvrx

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

MEDIUM 61

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js).

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00345 Published 2026-09-29 Fixed in 3.1.7 CWE-400

TI-2025-08513 CVE-2025-9288 · GHSA-95m3-7q98-8xr5

Missing type checks leading to hash rewind and passing on crafted data

HIGH 72

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00738 Published 2025-08-20 Partial fix · 2.4.12 CWE-20

TI-2025-08512 CVE-2025-9287 · GHSA-cpq7-6gpm-g9rc

Missing type checks leading to hash rewind and passing on crafted data

HIGH 72

Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0055 Published 2025-08-20 Partial fix · 1.0.5 CWE-20

TI-2023-24861 CVE-2023-46234 · GHSA-x9w5-v3q2-3rhw

browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack

LOW 34

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00563 Published 2023-10-26 Partial fix · 4.2.2 CWE-347

Vulnerabilities

Filters

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

Missing type checks leading to hash rewind and passing on crafted data

Missing type checks leading to hash rewind and passing on crafted data

browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack