Skip to content
Fencer Intel
critical 9.1

CVE-2025-6545 json

pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

published last yr. modified last mo. also GHSA-h7cp-r72f-jxh6 , EUVD-2025-18922

cvss
9.1
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js.

This issue affects pbkdf2: from 3.0.10 through 3.1.2.

Patch / fix

  • npm pbkdf2 3.1.3
  • node-pbkdf2 Debian 14 3.1.3+~3.1.2-1

debian advisories DEBIAN-CVE-2025-6545

  • node-pbkdf2 Ubuntu Pro 18.04 LTS 3.0.14-2ubuntu0.1~esm1
  • node-pbkdf2 Ubuntu Pro 20.04 LTS 3.0.16-1ubuntu0.1~esm1
  • node-pbkdf2 Ubuntu Pro 22.04 LTS 3.1.2-2ubuntu0.1~esm1
  • node-pbkdf2 Ubuntu Pro 24.04 LTS 3.1.2-3ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2025-6545

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • aws-cli SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 1.33.26-150400.34.7.1
  • python-boto3 SLE Module for Python 3 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 1.34.138-150400.27.7.1
  • python-flaky openSUSE Leap 15.6 3.8.1-150400.14.6.1
  • python-pluggy SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 1.5.0-150400.14.10.1
  • python-pytest SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 8.3.5-150400.3.9.1
  • python-botocore SLE Module for Python 3 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 1.34.144-150400.41.7.1
  • python-coverage SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +9 more 7.6.10-150400.12.6.1
  • python-pytest-cov SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 6.2.1-150400.12.6.1

suse advisories SUSE-SU-2025:3744-1

  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1
  • python-pytest-html openSUSE Tumbleweed 4.1.1-6.1

opensuse advisories openSUSE-SU-2026:11126-1openSUSE-SU-2025:15280-1

Is CVE-2025-6545 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-6545 updated cvss 8.1

pbkdf2: pbkdf2 silently returns predictable key material

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-hub-api-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8
    affected: no fix available
  • Red Hat OpenShift Serverless openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle
    affected: no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry
    affected: no fix available
  • Red Hat Fuse 7 io.apicurio-apicurito, io.syndesis-syndesis-parent Red Hat Integration Camel K 1 io.apicurio-apicurio-registry Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel9 Red Hat streams for Apache Kafka 2 com.github.streamshub-console
    affected: no fix available
  • Red Hat Developer Hub 1.7 rhdh 1.7.0-1754936470
    fixed: vendor fix RHSA-2025:14090
  • Red Hat OpenShift Pipelines 1.15 openshift-pipelines 1771425314, openshift-pipelines 1771964224, openshift-pipelines 1772036471
    fixed: vendor fix RHSA-2026:3710
  • Red Hat OpenShift Pipelines 1.19 openshift-pipelines v1.19.4-1764819005
    fixed: vendor fix RHSA-2025:22905
show 10 more
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh 2.4.7-1751549390
    fixed: vendor fix RHSA-2025:10738
  • Red Hat Trusted Artifact Signer 1.2 rhtas 1.2.1-1755456740
    fixed: vendor fix RHSA-2025:14474
  • Red Hat Developer Hub 1 rhdh/rhdh-rhel9-operator
    not affected: component not present
  • Red Hat Developer Hub 1.7 rhdh 1.7.0-1754935808, rhdh 1.7.0-1754942441
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 7 firefox, thunderbird
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux 8 pcs, grafana, mozjs60, pcs-snmp, grafana-loki, grafana-mssql, +11 more
    not affected: component not present
  • Red Hat Enterprise Linux 9 gjs, pcs, polkit, pcs-snmp, polkit-libs
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-data-science-pipelines-argo-argoexec-rhel8, rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8
    not affected: component not present
  • Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel8 Red Hat OpenShift Pipelines 1.15 openshift-pipelines 1771510606, openshift-pipelines 1771964016, openshift-pipelines 1771964021, openshift-pipelines 1771964042, openshift-pipelines 1771964076, openshift-pipelines 1771964091, +16 more Red Hat OpenShift Pipelines 1.19 openshift-pipelines v1.19.4-1764635259, openshift-pipelines v1.19.4-1764769550, openshift-pipelines v1.19.4-1764769552, openshift-pipelines v1.19.4-1764769674, openshift-pipelines v1.19.4-1764769677, openshift-pipelines v1.19.4-1764771272, +21 more Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh 9.4-1751554068, openshift-service-mesh 2.4.7-1751438375, openshift-service-mesh 2.4.7-1751549742
    not affected: vulnerable code not present
  • Red Hat Process Automation 7 org.uberfire-uberfire-parent, org.kie.workbench-kie-wb-common, org.kie-process-migration-service
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm pbkdf2
>=3.0.10, <3.1.3
3.1.3

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.