GHSA-V62P-RQ8G-8H59 pbkdf2 silently disregards Uint8Array input, returning static keys

🗓️ 23 Jun 2025 22:42:00Reported by GoogleType

osv

osv🔗 osv.dev👁 1 Views

Pbkdf2 ignores Uint8Array input on Node.js versions below 3.0.0, returning static hashes.

Reporter	Title	Published	Views	Family All 47
IBM Security Bulletins	Security Bulletin: Vulnerabilities in pbkdf2 affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Sep 202511:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in QRadar Suite Software	13 Mar 202619:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Log Source Management app for IBM QRadar SIEM includes components with known vulnerabilities	15 Aug 202514:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in pbkdf2 affect IBM Decision Optimization for IBM Cloud Pak for Data (CVE-2025-6545 and CVE-2025-6547)	3 Sep 202508:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Dashboard operands are vulnerable to loss of confidentiality [CVE-2025-6545] [CVE-2025-6547]	26 Jun 202516:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in pbkdf2-3.1.2.tgz	22 Oct 202511:24	–	ibm
ATTACKERKB	CVE-2025-6547	23 Jun 202519:00	–	attackerkb
Circl	CVE-2025-6547	23 Jun 202520:28	–	circl
CNNVD	Browserify pbkdf2 安全漏洞	23 Jun 202500:00	–	cnnvd
CVE	CVE-2025-6547	23 Jun 202519:00	–	cve

Source	Link
github	www.github.com/browserify/pbkdf2/security/advisories/GHSA-v62p-rq8g-8h59
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-6547
github	www.github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb
github	www.github.com/browserify/pbkdf2

22 Feb 2026 23:19Current

5.9Medium risk

Vulners AI Score5.9

CVSS 49.1

EPSS0.00091

pbkdf2 vulnerability uint8array input nodejs versions below static hashes toBuffer method