CoreCVE
Back

CRITICAL

pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

Published Jun 23, 2025

Description

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js.

This issue affects pbkdf2: from 3.0.10 through 3.1.2.

Affected products

Remediation

Red Hat statement

This flaw is rated important because it causes the pbkdf2 module to quietly return weak or zero-filled keys when certain algorithm names are used incorrectly in browsers or bundled code, this causes the function to silently return a predictable value (such as a zero-filled buffer or uninitialized memory) instead of a securely derived key, completely undermining the confidentiality and integrity of any cryptographic operation where attackers could guess or reuse these keys to access or change protected data.

Weaknesses (1)

CWE-20

Improper Input Validation

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner harborist
Published Jun 23, 2025
Updated Jun 23, 2025
Reserved Jun 23, 2025
Link CVE-2025-6545
CISA Vulnrichment
Updated Jun 23, 2025
NVD
Status Deferred
Modified Jun 17, 2026
Link CVE-2025-6545
Red Hat
Severity Important
Public date Jun 23, 2025
Links CVE-2025-6545 - Bugzilla
ENISA EUVD
Assigner harborist
Published Jun 23, 2025
Updated Jun 23, 2025
Exploited since n/a
Link EUVD-2025-18922
EUVD-2025-18922 GHSA-H7CP-R72F-JXH6