Skip to content
OpenAdvisories

Package · npm

xml-crypto

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Critical 9.3
    CVE-2025-29775 Public exploit EPSS 10%

    xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

    xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto …

    node-saml xml-crypto xml-crypto npm
  • Critical 9.3
    CVE-2025-29774 Public exploit

    xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

    xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto …

    node-saml xml-crypto xml-crypto npm
  • Critical 10.0
    CVE-2024-32962 Public exploit

    XML signature verification bypass due improper verification of signature / signature spoofing

    xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-2008061…

    node-saml xml-crypto xml-crypto npm
  • High —
    GHSA-c27r-x354-4m68

    xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

    ### Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. ### Patches Version 2.0.0 has the fix. ### Workarounds The recommendation is to upgrade. In case tha…

    xml-crypto npm