Critical DLA-4302-1 1 CVE

node-sha.js - security update

Published Sep 16, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	node-sha.js	2.4.11-2+deb11u1

Vulnerabilities 1

Critical 9.1

CVE-2025-9288

Missing type checks leading to hash rewind and passing on crafted data

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

opensearch-dashboards-3 opensearch-dashboards-3-dashboards-observability opensearch-dashboards-3-dashboards-reporting opensearch-dashboards-3-alerting-dashboards-plugin Debian Ubuntu Azure Linux Wolfi npm

Aug 20, 2025