CVE-2025-6545 | THREATINT

Description

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

PUBLISHED Reserved 2025-06-23 | Published 2025-06-23 | Updated 2025-06-23 | Assigner harborist

CRITICAL: 9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H

Problem types

CWE-20 Improper Input Validation

Product status

Default status

unaffected

3.0.10 (semver)

affected

References

github.com/...pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6 third-party-advisory

github.com/...ommit/9699045c37a07f8319cfb8d44e2ff4252d7a7078

github.com/...ommit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb patch

cve.org (CVE-2025-6545)

nvd.nist.gov (CVE-2025-6545)

Download JSON