Skip to content
OpenAdvisories
High · 8.7 CVE-2025-27611 EUVD-2025-12752GHSA-xq7p-g2vc-g82p

base-x homograph attack allows Unicode lookalike characters to bypass validation.

Published Apr 30, 2025 · Updated May 1, 2025 · Assigned by GitHub_M

Vendor: cryptocoinjs Product: base-x Package: base-x Ecosystem: npm

Description

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1.

Affected products

VendorProductAffectedFixed
cryptocoinjs base-x = 5.0.0, = 4.0.0, < 3.0.11 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.33.0-3.redhat_00017.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-apache-commons-beanutils 1.11.0-1.redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.0.6-2.redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-apache-mime4j +2 0.8.12-1.redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.8.0-1.GA_redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-elytron-web 4.0.3-1.Final_redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-fastinfoset 2.1.1-1.redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-hal-console 3.6.24-1.Final_redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-hibernate +2 6.2.36-1.Final_redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-4.redhat_00006.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-jboss-remoting 5.0.31-1.Final_redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.3.3-1.Final_redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-narayana +8 6.0.6-1.Final_redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-neethi 3.2.1-1.redhat_00002.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-reactivex-rxjava2 2.2.21-3.redhat_00002.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.17-1.redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-velocity +1 2.3.0-4.redhat_00010.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-wildfly +4 8.0.8-4.GA_redhat_00006.1.el8eap RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.2.11-1.Final_redhat_00001.1.el8eap RHSA-2025:10453, RHSA-2025:10452

Affected packages

EcosystemPackageAffectedFixedRecord
npm base-x >= 5.0.0, < 5.0.1 5.0.1 GHSA-xq7p-g2vc-g82p
npm base-x >= 4.0.0, < 4.0.1 4.0.1 GHSA-xq7p-g2vc-g82p
npm base-x < 3.0.11 3.0.11 GHSA-xq7p-g2vc-g82p

Advisories 2

References