Critical DSA-6002-1 1 CVE

node-sha.js - security update

Published Sep 16, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

Release	Package	Fixed in
Debian · 12	node-sha.js	2.4.11+~2.4.0-2+deb12u1
Debian · 13	node-sha.js	2.4.11+~2.4.0-2+deb13u1

Vulnerabilities 1

Critical 9.1

CVE-2025-9288

Missing type checks leading to hash rewind and passing on crafted data

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

opensearch-dashboards-3 opensearch-dashboards-3-dashboards-observability opensearch-dashboards-3-dashboards-reporting opensearch-dashboards-3-alerting-dashboards-plugin Debian Ubuntu Azure Linux Wolfi npm

Aug 20, 2025