cipher-base is missing type checks, leading to hash rewind and passing on crafted data

Description

This affects e.g. create-hash (and crypto-browserify), so I’ll describe the issue against that package Also affects create-hmac and other packages

Node.js createHash works only on strings or instances of Buffer, TypedArray, or DataView.

Missing input type checks (in npm create-hash polyfill of Node.

Recommendation

Update the cipher-base package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.0.4
• Patched version(s): 1.0.5

References

• GHSA-cpq7-6gpm-g9rc
• lists.debian.org
• CVE-2025-9287
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• sha.js is missing type checks leading to hash rewind and passing on crafted data - CVE-2025-9288
• ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation - CVE-2025-32029
• Mermaid does not properly sanitize architecture diagram iconText leading to XSS - CVE-2025-54880
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core-base - CVE-2025-53892

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

cipher-base