{"schema_version":"1.9.0","id":"CVE-2025-6547","published":"2025-06-23T19:00:45.472Z","modified":"2026-08-12T03:51:44.990661540Z","aliases":["GHSA-v62p-rq8g-8h59"],"related":["CGA-pg8r-8m63-v32p","SUSE-SU-2025:3744-1","openSUSE-SU-2026:11126-1"],"summary":"On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys","details":"Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/browserify/pbkdf2","events":[{"introduced":"0"},{"fixed":"e3102a8cd4830a3ac85cd0dd011cc002fdde33bb"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v3.1.2","v3.1.1","v3.1.0","v3.0.17","v3.0.16","v3.0.15","v3.0.14","v3.0.13","v3.0.12","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","3.0.4","v3.0.3","3.0.2","3.0.1","2.0.1","2.0.0","1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6547.json"}}],"references":[{"type":"WEB","url":"https://npmjs.com/pbkdf2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6547.json"},{"type":"ADVISORY","url":"https://github.com/browserify/pbkdf2/security/advisories/GHSA-v62p-rq8g-8h59"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6547"},{"type":"FIX","url":"https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb"},{"type":"PACKAGE","url":"https://github.com/browserify/pbkdf2"}],"database_specific":{"cna_assigner":"harborist","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6547.json","unresolved_ranges":[{"extracted_events":[{"introduced":">= 1 <=3.1.2"},{"last_affected":">= 1 <=3.1.2"}],"source":"AFFECTED_FIELD"}]},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H"}]}