GHSA-95M3-7Q98-8XR5 sha.js is missing type checks leading to hash rewind and passing on crafted data

Summary This is the same as GHSA-cpq7-6gpm-g9rc but just for sha.js, as it has its own implementation. Missing input type checks can allow types other than a well-formed Buffer or string, resulting in invalid values, hanging and rewinding the hash state including turning a tagged hash into an...

sha.js is missing type checks leading to hash rewind and passing on crafted data

Summary This is the same as GHSA-cpq7-6gpm-g9rc but just for sha.js, as it has its own implementation. Missing input type checks can allow types other than a well-formed Buffer or string, resulting in invalid values, hanging and rewinding the hash state including turning a tagged hash into an...

Function Call With Incorrect Argument Type

Overview Affected versions of this package are vulnerable to Function Call With Incorrect Argument Type due to missing type checks in the update function in the hash.js file. An attacker can manipulate input data by supplying crafted data that causes a hash rewind and unintended data processing...

org.webjars.npm:crypto-browserify (>=3.2.6 <=3.2.8), org.webjars.npm:node-libs-browser (>=0.5.2 <=0.5.3) +1 more potentially affected by CVE-2025-9288 via org.webjars.npm:sha.js (>=2.2.6 <=2.3.6)

org.webjars.npm:sha.js MAVEN version =2.2.6, =3.2.6, =0.5.2, =0.5.3 - org.webjars.npm:shasum =1.0.1 Source cves: CVE-2025-9288 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-12089401...

2d-json-schema-editor-visual (>=1.0.2 <=1.0.7), 37sy-build (>=1.0.0 <=1.3.3) +3989 more potentially affected by CVE-2025-9288 via sha.js (>=2.1.1 <=2.4.11)

sha.js NPM version =2.1.1, =1.0.2, =1.0.0, =1.0.0, =1.0.1, =1.0.0, =0.1.6, =1.0.0, =0.0.4, =0.1.0, =7.13.4, =18.0.0, =18.1.2 - @ajhyndman/relay =1.6.0-1 and more Source cves: CVE-2025-9288 Source advisory: SNYK:JS-SHAJS-12089400...

CVE-2025-9288

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11...

AZL-66570 CVE-2025-9288 affecting package reaper 3.1.1-22

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11...

UBUNTU-CVE-2025-9288

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11...

CVE-2025-9288

The CVE-2025-9288 issue is an Improper Input Validation vulnerability in sha.js (node-sha.js) with incomplete type checks that can lead to Input Data Manipulation. Public reports tie the vulnerability to sha.js up to version 2.4.11. Debian advisories (DSA-6002-1, DLA-4302-1, DLA-4291-1) describe ...

CVE-2025-9288 Missing type checks leading to hash rewind and passing on crafted data

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11...

CVE-2025-9288 Missing type checks leading to hash rewind and passing on crafted data

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11...

CVE-2025-9288 Missing type checks leading to hash rewind and passing on crafted data

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11...

sha.js 安全漏洞

sha.js is an open source application from Browserify. A security vulnerability exists in sha.js version 2.4.11 and earlier, which stems from improper input validation and could lead to tampering of input data...

PT-2025-34165

Name of the Vulnerable Software and Affected Versions sha.js versions through 2.4.11 Description An improper input validation vulnerability exists in sha.js, allowing for input data manipulation. This flaw can lead to hash collisions and potentially private key extraction, threatening web...