cipher-base is missing type checks, leading to hash rewind and passing on crafted data

Description

This affects e.g. create-hash (and crypto-browserify), so I’ll describe the issue against that package Also affects create-hmac and other packages

Node.js createHash works only on strings or instances of Buffer, TypedArray, or DataView.

Missing input type checks (in npm create-hash polyfill of Node.

Recommendation

Update the cipher-base package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.0.4
• Patched version(s): 1.0.5

References

• GHSA-cpq7-6gpm-g9rc
• lists.debian.org
• CVE-2025-9287
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6