Description
On historic but declared as supported Node.js versions (0.12-2.x), pbkdf2 silently disregards Uint8Array input
This only affects Node.js <3.0.0, but pbkdf2 claims to:
- Support Node.js >= 0.
Recommendation
Update the pbkdf2 package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, <= 3.1.2
- Patched version(s): 3.1.3
References
Could your website be exposed too?
SmartScanner can check your website for pbkdf2 silently disregards Uint8Array input, returning static keys and gives you actionable findings to investigate.
Start a free scanRelated Issues
- auth-js Vulnerable to Insecure Path Routing from Malformed User Input - CVE-2025-48370
- AWS Amplify Studio UI Component Properties Has an Input Validation Issue - CVE-2025-4318
- react-native-keys insecurely stores encryption cipher and Base64 chunks - CVE-2025-45001
- pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos - CVE-2025-6545
You might also like:
See something that needs correcting? Let us knowUpdated February 17, 2026