Summary
Nikita Skovoroda discovered that sha.js did not properly handle
certain inputs. An attacker could possibly use this issue to manipulate
the internal state of hash functions, resulting in hash collisions,
denial of service, or other unspecified impact.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | node-sha.js | 2.4.11+~2.4.0-1ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | node-sha.js | 2.4.11+~2.4.0-2+deb13u1build0.24.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | node-sha.js | 2.4.9-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | node-sha.js | 2.4.11-2ubuntu0.1~esm1 |
Vulnerabilities 1
-
Critical 9.1
Missing type checks leading to hash rewind and passing on crafted data
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
References
-
report
https://ubuntu.com/security/CVE-2025-9288