Description
This is the same as GHSA-cpq7-6gpm-g9rc but just for sha.js, as it has its own implementation.
Missing input type checks can allow types other than a well-formed Buffer or string, resulting in invalid values, hanging and rewinding the hash state (including turning a tagged hash into an untagged hash), or other generally undefined behaviour.
Recommendation
Update the sha.js package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.4.11
- Patched version(s): 2.4.12
References
Could your website be exposed too?
SmartScanner can check your website for sha.js is missing type checks leading to hash rewind and passing on crafted data and gives you actionable findings to investigate.
Start a free scanRelated Issues
- cipher-base is missing type checks, leading to hash rewind and passing on crafted data - CVE-2025-9287
- The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008
- Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler - CVE-2025-27098
- Axios is vulnerable to DoS attack through lack of data size check - CVE-2025-58754
You might also like:
See something that needs correcting? Let us knowUpdated November 03, 2025