Skip to content
OpenAdvisories

Package · Debian

node-pbkdf2

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-102414

    pbkdf2 rehashes long passwords on every iteration, enabling denial of service

    pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on ever…

    browserify pbkdf2 pbkdf2 node-pbkdf2 Debian Ubuntu npm