Description
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | sshpk node module | Versions up to and including 1.13.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-sshpk | 1.13.1+dfsg-2 | — |
| Debian 13 | node-sshpk | 1.13.1+dfsg-2 | — |
| Debian 12 | node-sshpk | 1.13.1+dfsg-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-sshpk | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.17.0-2.el7 | RHSA-2020:2625 |
| RHEL 3 | rh-nodejs8-npm | 6.13.4-8.17.0.2.el7 | RHSA-2020:2625 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | sshpk | < 1.13.2 | 1.13.2 | GHSA-2m39-62fm-q8r3 |
Advisories 3
- WID-SEC-2026-2183 Red Hat Software Collections: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 2, 2026
- RHSA-2020:2625 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024