CVE-2025-6545: pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

Severity: critical (CVSS 9.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-23 · updated 2026-06-17
Weakness: CWE-20

Description

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

Affected products

Npm Pbkdf2: from 3.0.10 before 3.1.3 — fixed in 3.1.3

How to fix

Upgrade to a fixed version: Npm Pbkdf2 3.1.3. Check the vendor advisory for mitigations.

References

https://github.com/browserify/pbkdf2/commit/9699045c37a07f8319cfb8d44e2ff4252d7a7078
https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb
https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6

Get alerted when CVE-2025-6545 or the next vulnerability affects your stack