Description
Manifest employs a weak password hashing implementation that uses SHA3 without a salt. This exposes user passwords to a higher risk of being cracked if an attacker gains access to the database.
Recommendation
Update the manifest package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.9.2
- Patched version(s): 4.9.2
References
Related Issues
- Elliptic Uses a Cryptographic Primitive with a Risky Implementation - CVE-2025-14505
- sha.js is missing type checks leading to hash rewind and passing on crafted data - CVE-2025-9288
- cipher-base is missing type checks, leading to hash rewind and passing on crafted data - CVE-2025-9287
- Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements - CVE-2025-12758
You might also like:
- Tags:
- npm
- manifest
Anything's wrong? Let us know Last updated on March 04, 2025