CVE-2025-9288
Missing type checks leading to hash rewind and passing on crafted data
Summary
Missing type checks leading to hash rewind and passing on crafted data
Original description
The description as published by the source.
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-9288 node-sha.js Fixed in: 2.4.11-2+deb11u1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web lists.debian.org
- web npmjs.com
- web cve.org