CoreCVE
Back

CRITICAL

Missing type checks leading to hash rewind and passing on crafted data

Published Aug 20, 2025

Description

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

Affected products

Remediation

Red Hat statement

This vulnerability was marked as Important rather then Critical because while the lack of input type checks in sha.js allows for hash state rewinding, crafted collisions, and potential denial of service, the vulnerability requires highly specific crafted input objects that are unlikely to occur in typical real-world usage, especially since most applications pass well-formed strings or buffers to hashing functions. Moreover, the cryptographic breakages described, such as nonce reuse leading to private key extraction, are indirect and depend on downstream libraries misusing sha.js for sensitive operations without additional validation layers. As a result, the flaw significantly undermines correctness and robustness of the hashing API, but its exploitability in common production systems is constrained, which could justify viewing it as an Important vulnerability rather than a Critical one. The flaw requires applications to pass attacker-controlled, non-standard JavaScript objects into hash.update(). Most real-world Node.js applications and libraries already use Buffer, TypedArray, or String inputs, which are unaffected. Furthermore, Node’s built-in crypto module, which is widely adopted, enforces stricter type-checking and is not impacted. As a result, the vulnerability mainly threatens projects that (a) directly depend on sha.js for cryptographically sensitive operations, and (b) hash untrusted input without type validation.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-20

Improper Input Validation

References (11)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner harborist
Published Aug 20, 2025
Updated Nov 3, 2025
Reserved Aug 20, 2025
Link CVE-2025-9288
CISA Vulnrichment
Updated Aug 21, 2025
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2025-9288
Red Hat
Severity Important
Public date Aug 20, 2025
Links CVE-2025-9288 - Bugzilla
ENISA EUVD
Assigner harborist
Published Aug 20, 2025
Updated Nov 3, 2025
Exploited since n/a
Link EUVD-2025-25403
EUVD-2025-25403 GHSA-95M3-7Q98-8XR5