Skip to content
OpenAdvisories

Package · Debian

node-pbkdf2

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 3.7
    CVE-2026-102414

    pbkdf2 rehashes long passwords on every iteration, enabling denial of service

    pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on ever…

    browserify pbkdf2 pbkdf2 node-pbkdf2 Debian Ubuntu npm
  • Critical 9.1
    CVE-2025-6545

    pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

    Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

    pbkdf2 node-pbkdf2 node-pbkdf2 Debian Ubuntu npm