Skip to content
OpenAdvisories
Critical · 9.1 CVE-2025-9288 EUVD-2025-25403GHSA-95m3-7q98-8xr5

Missing type checks leading to hash rewind and passing on crafted data

Published Aug 20, 2025 · Updated Nov 3, 2025 · Assigned by harborist

Package: node-sha.js Package: node-sha.js Package: opensearch-dashboards-3 Package: opensearch-dashboards-3-alerting-dashboards-plugin Package: opensearch-dashboards-3-anomaly-detection-dashboards-plugin Package: opensearch-dashboards-3-config Package: opensearch-dashboards-3-dashboards-maps Package: opensearch-dashboards-3-dashboards-notifications Package: opensearch-dashboards-3-dashboards-observability Package: opensearch-dashboards-3-dashboards-query-workbench Package: opensearch-dashboards-3-dashboards-reporting Package: opensearch-dashboards-3-dashboards-search-relevance Package: opensearch-dashboards-3-index-management-dashboards-plugin Package: opensearch-dashboards-3-ml-commons-dashboards Package: opensearch-dashboards-3-security-analytics-dashboards-plugin Package: opensearch-dashboards-3-security-dashboards-plugin Package: reaper Package: sha.js Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

Affected products

VendorProductAffectedFixed
— sha.js ≤ 2.4.11 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-sha.js 2.4.12+~3.0.5-1 —
Debian 13 node-sha.js 2.4.11+~2.4.0-2+deb13u1 DSA-6002-1
Debian 12 node-sha.js 2.4.11+~2.4.0-2+deb12u1 DSA-6002-1
Debian 11 node-sha.js 2.4.11-2+deb11u1 DLA-4302-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS node-sha.js 2.4.11+~2.4.0-2+deb13u1build0.24.04.1 USN-7778-1
Ubuntu 22.04 LTS node-sha.js 2.4.11+~2.4.0-1ubuntu0.1 USN-7778-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS node-sha.js 2.4.11-2ubuntu0.1~esm1 USN-7778-1
Ubuntu Pro 18.04 LTS node-sha.js 2.4.9-1ubuntu0.1~esm1 USN-7778-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) reaper No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling opensearch-dashboards-3 +13 3.1.0-r4 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm sha.js < 2.4.12 2.4.12 GHSA-95m3-7q98-8xr5

Advisories 7

References