Skip to content
Fencer Intel
critical 9.1

CVE-2025-9287 json

Missing type checks leading to hash rewind and passing on crafted data

published last yr. modified last mo. also GHSA-cpq7-6gpm-g9rc , EUVD-2025-25405

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.

Patch / fix

  • npm cipher-base 1.0.5
  • node-cipher-base Debian 12 1.0.4-6+deb12u1
  • node-cipher-base Debian 13 1.0.4-6+deb13u1
  • node-cipher-base Debian 14 1.0.6-1

debian advisories DEBIAN-CVE-2025-9287

  • node-cipher-base Ubuntu 22.04 LTS 1.0.4-6+deb13u1ubuntu0.22.04.1
  • node-cipher-base Ubuntu 24.04 LTS 1.0.4-6+deb13u1ubuntu0.24.04.1
  • node-cipher-base Ubuntu Pro 18.04 LTS 1.0.4-1ubuntu0.1~esm2
  • node-cipher-base Ubuntu Pro 20.04 LTS 1.0.4-4ubuntu0.1~esm2

ubuntu advisories UBUNTU-CVE-2025-9287

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-bqplot openSUSE Tumbleweed 0.12.45-12.1

opensuse advisories openSUSE-SU-2025:15484-1

Is CVE-2025-9287 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-9287 updated cvss 7.5

cipher-base: Cipher-base hash manipulation

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-api-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Serverless openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 7 firefox, thunderbird
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Fuse 7 io.apicurio-apicurito, io.syndesis-syndesis-parent
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-agent-rhel8, openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-extensions-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
show 21 more
  • Red Hat streams for Apache Kafka 2 com.github.streamshub-console Red Hat streams for Apache Kafka 3 com.github.streamshub-console
    affected: workaround, no fix available
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine
    fixed: vendor fix RHSA-2025:23528
  • Red Hat multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/cluster-api-rhel9 v2.7.6-3
    fixed: vendor fix RHSA-2025:18278
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1765829333
    fixed: vendor fix RHSA-2026:0722
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine
    fixed: vendor fix RHSA-2025:19332
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2
    fixed: vendor fix RHSA-2025:23529
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/memcached-rhel9 v2.12.5-3
    fixed: vendor fix RHSA-2025:18744
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1768001980
    fixed: vendor fix RHSA-2026:0627
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2
    fixed: vendor fix RHSA-2025:19335
  • Red Hat Developer Hub 1.6 rhdh 1.6.4-1756241191
    fixed: vendor fix RHSA-2025:14767
  • Red Hat Developer Hub 1.7 rhdh 1.7.1-1757963043
    fixed: vendor fix RHSA-2025:16020
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 devspaces 3.23-1756509551, devspaces 3.23-1757019057, devspaces 3.23-1757618807
    fixed: vendor fix RHSA-2025:15847
  • Red Hat OpenShift Pipelines 1.15 openshift-pipelines 1771425314, openshift-pipelines 1771964224, openshift-pipelines 1772036471
    fixed: vendor fix RHSA-2026:3710
  • Red Hat OpenShift Pipelines 1.19 openshift-pipelines v1.19.4-1764819019
    fixed: vendor fix RHSA-2025:22905
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1765517627, multicluster-engine 1765517785, multicluster-engine 1765522347, multicluster-engine 1765522349, multicluster-engine 1765669648, multicluster-engine 1765755875, +20 more Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2 Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1767311055, rhacm2 1767311056, rhacm2 1767397077, rhacm2 1767397082, rhacm2 1767397328, rhacm2 1767397377, +37 more Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2
    not affected: vulnerable code not present
  • Red Hat Developer Hub 1 rhdh/rhdh-rhel9-operator
    not affected: component not present
  • Red Hat Developer Hub 1.6 rhdh 1.6.4-1756218204, rhdh 1.6.4-1756244632 Red Hat Developer Hub 1.7 rhdh 1.7.1-1757949497, rhdh 1.7.1-1757967808
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 pcs, grafana, mozjs60, pcs-snmp, grafana-loki, grafana-mssql, +11 more
    not affected: component not present
  • Red Hat Enterprise Linux 9 gjs, pcs, polkit, pcs-snmp, polkit-libs
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-data-science-pipelines-argo-argoexec-rhel8, rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8
    not affected: component not present
  • Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9, devspaces/dashboard-rhel8, devspaces/configbump-rhel9, devspaces/imagepuller-rhel9, devspaces-tech-preview/idea-rhel9, devspaces/devspaces-rhel9-operator, +1 more Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 devspaces 3.23-1756504388, devspaces 3.23-1756506343, devspaces 3.23-1756507311, devspaces 3.23-1756753588, devspaces 3.23-1756828766, devspaces 3.23-1757017659, +6 more Red Hat OpenShift GitOps openshift-gitops-1/dex-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/console-plugin-rhel8, openshift-gitops-1/gitops-rhel8-operator, +1 more
    not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/browserify/cipher-base/security/advisories/GHSA-cpq7-6gpm-g9rc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm cipher-base
<1.0.5
1.0.5

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.