Skip to content
OpenAdvisories

Vendor

node-saml

9 known vulnerabilities.

node-saml at a glance

Last 12 months
1
Critical · all time
5
Exploited · all time
0
Public exploit · all time
4
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 1 vulnerability, 1 critical Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202511
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202511
Jun 202500
May 202500
Apr 202500
Mar 202522
Feb 202500
Jan 202500
Dec 202400

Products

node-saml 4 xml-crypto 3 passport-saml 2
All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Critical 9.3
    CVE-2025-54369

    Node-SAML SAML Authentication Bypass

    Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signatur…

    node-saml node-saml @node-saml/node-saml node-saml npm
  • Critical 10.0
    CVE-2025-54419

    Node-SAML Contains SAML Signature Verification Vulnerability

    A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attack…

    node-saml node-saml @node-saml/node-saml passport-saml npm
  • Critical 9.3
    CVE-2025-29775 Public exploit EPSS 10%

    xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

    xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto …

    node-saml xml-crypto xml-crypto npm
  • Critical 9.3
    CVE-2025-29774 Public exploit

    xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

    xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto …

    node-saml xml-crypto xml-crypto npm
  • Critical 10.0
    CVE-2024-32962 Public exploit

    XML signature verification bypass due improper verification of signature / signature spoofing

    xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-2008061…

    node-saml xml-crypto xml-crypto npm
  • Medium 5.3
    CVE-2023-40178

    @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError

    Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user whe…

    node-saml node-saml @node-saml/node-saml npm
  • High 7.7
    CVE-2022-39300

    Signature bypass via multiple root elements in node-SAML

    node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary ID…

    node-saml node-saml node-saml npm
  • High 7.4
    CVE-2022-39299 Public exploit

    Signature bypass via multiple root elements in Passport-SAML

    Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession…

    node-saml passport-saml @node-saml/node-saml passport-saml npm
  • Medium 5.3
    CVE-2021-39171

    Unlimited transforms allowed for signed nodes

    Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or…

    node-saml passport-saml passport-saml npm