Skip to content
OpenAdvisories
Critical USN-8452-1 1 CVE

node-pbkdf2 vulnerability

Published Jun 18, 2026 · Updated Jun 18, 2026

Ecosystem: Ubuntu

Summary

Nikita Skovoroda discovered that pbkdf2 did not properly validate
certain algorithm names. An attacker could possibly use this issue to
generate predictable cryptographic keys, resulting in signature spoofing.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS node-pbkdf2 3.0.14-2ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS node-pbkdf2 3.0.16-1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS node-pbkdf2 3.1.2-2ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS node-pbkdf2 3.1.2-3ubuntu0.1~esm1

Vulnerabilities 1

  • Critical 9.1
    CVE-2025-6545

    pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

    Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

    pbkdf2 node-pbkdf2 node-pbkdf2 Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2025-6545