CVE-2025-6545

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/browserify/pbkdf2/commit/9699045c37a07f8319cfb8d44e2ff4252d7a7078
https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb
https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) La vulnerabilidad de validación de entrada incorrecta en pbkdf2 permite la suplantación de firma mediante validación incorrecta. Esta vulnerabilidad está asociada con los archivos de programa lib/to-buffer.Js. Este problema afecta a pbkdf2 desde la versión 3.0.10 hasta la 3.1.2.

23 Jun 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-23 19:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-6545

Mitre link : CVE-2025-6545

CVE.ORG link : CVE-2025-6545

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-6545", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-23T19:15:25.220", "references": [{"url": "https://github.com/browserify/pbkdf2/commit/9699045c37a07f8319cfb8d44e2ff4252d7a7078", "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158"}, {"url": "https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb", "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158"}, {"url": "https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6", "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js.\n\nThis issue affects pbkdf2: from 3.0.10 through 3.1.2."}, {"lang": "es", "value": "La vulnerabilidad de validaci\u00f3n de entrada incorrecta en pbkdf2 permite la suplantaci\u00f3n de firma mediante validaci\u00f3n incorrecta. Esta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/to-buffer.Js. Este problema afecta a pbkdf2 desde la versi\u00f3n 3.0.10 hasta la 3.1.2."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "7ffcee3d-2c14-4c3e-b844-86c6a321a158"}