sha.js is missing type checks leading to hash rewind and passing on crafted data

Description

This is the same as GHSA-cpq7-6gpm-g9rc but just for sha.js, as it has its own implementation.

Missing input type checks can allow types other than a well-formed Buffer or string, resulting in invalid values, hanging and rewinding the hash state (including turning a tagged hash into an untagged hash), or other generally undefined behaviour.

Recommendation

Update the sha.js package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.4.11
• Patched version(s): 2.4.12

References

• GHSA-95m3-7q98-8xr5
• www.cve.org
• lists.debian.org
• CVE-2025-9288
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• cipher-base is missing type checks, leading to hash rewind and passing on crafted data - CVE-2025-9287
• The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008
• Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler - CVE-2025-27098
• Axios is vulnerable to DoS attack through lack of data size check - CVE-2025-58754

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

sha.js