Strapi Password Hashing is Missing Maximum Password Length Validation

Description

Strapi’s password hashing implementation using bcryptjs lacks maximum password length validation. Since bcryptjs truncates passwords exceeding 72 bytes, this creates potential vulnerabilities such as authentication bypass and performance degradation.

Recommendation

Update the @strapi/core package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.10.3
• Patched version(s): 5.10.3

References

• GHSA-2cjv-6wg9-f4f3
• CVE-2025-25298
• CWE-261
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• @farmfe/core is Missing Origin Validation in WebSocket - CVE-2025-56647
• Strapi core vulnerable to sensitive data exposure via CORS misconfiguration - CVE-2025-53092
• Strapi may leak sensitive user information, user reset password, tokens via content-manager views (GHSA-v8gg-4mq2-88q4) - CVE-2023-36472
• Strapi may leak sensitive user information, user reset password, tokens via content-manager views - CVE-2023-36472

Tags:

npm

@strapi/core