Description
This affects both:
- Unsupported algos (e.g.
sha3-256/sha3-512/sha512-256) - Supported but non-normalized algos (e.g.
Sha256/Sha512/SHA1/sha-1/sha-256/sha-512)
All of those work correctly in Node.js, but this polyfill silently returns highly predictable ouput
Under Node.
Recommendation
Update the pbkdf2 package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.0.10, <= 3.1.2
- Patched version(s): 3.1.3
References
Could your website be exposed too?
SmartScanner can check your website for pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Predictable results in nanoid generation when given non-integer values - CVE-2024-55565
- pbkdf2 silently disregards Uint8Array input, returning static keys - CVE-2025-6547
- Socket.IO: Zero-attachment Memory Exhaustion - CVE-2026-69185
- parse-duration has a Regex Denial of Service that results in event loop delay and out of memory - CVE-2025-25283
You might also like:
See something that needs correcting? Let us knowUpdated June 23, 2025