Critical, CVSS 9.1npmAmendedPublished
cipher-base is missing type checks, leading to hash rewind and passing on crafted data
CVE-2025-9287 · GHSA-cpq7-6gpm-g9rc
- Affected
- npm cipher-base <= 1.0.4
- Fixed in
- 1.0.5· Vendor fix available
- Issue
- This affects e.g. create-hash (and crypto-browserify), so I'll describe the issue against that package Also affects create-hmac and other packages Node.js createHash works only on strings or instances of Buffer, TypedArray, or DataView. Missing input type checks (in npm create-hash polyfill of Node.js createHash) can allow types other than a well-formed Buffer or string, resulting in invalid values, hanging and rewinding the hash state (including turning a tagged hash into an untagged hash), or other generally undefined behaviour. Details See PoC PoC Output: This works with: But there are other types of input which lead to unchecked results Impact 1. Hash state rewind on {length: -x}. This is behind the PoC above, also this way an attacker can turn a tagged hash in cryptographic libraries into an untagged hash. 2. Value miscalculation, e.g. a collision is generated by { length: buf.length, ...buf, 0: buf[0] + 256 } This will result in the same hash as of buf, but can be…
Recommended action: Upgrade to 1.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.