Skip to content
Fencer Intel
critical 9.1

CVE-2025-9288 json

Missing type checks leading to hash rewind and passing on crafted data

published last yr. modified last mo. also GHSA-95m3-7q98-8xr5 , EUVD-2025-25403

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

Patch / fix

  • npm sha.js 2.4.12
  • node-sha.js Debian 12 2.4.11+~2.4.0-2+deb12u1
  • node-sha.js Debian 13 2.4.11+~2.4.0-2+deb13u1
  • node-sha.js Debian 14 2.4.12+~3.0.5-1

debian advisories DEBIAN-CVE-2025-9288

  • node-sha.js Ubuntu 22.04 LTS 2.4.11+~2.4.0-1ubuntu0.1
  • node-sha.js Ubuntu 24.04 LTS 2.4.11+~2.4.0-2+deb13u1build0.24.04.1
  • node-sha.js Ubuntu Pro 18.04 LTS 2.4.9-1ubuntu0.1~esm1
  • node-sha.js Ubuntu Pro 20.04 LTS 2.4.11-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2025-9288

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2025-9288 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-9288 updated cvss 7.7

sha.js: Missing type checks leading to hash rewind and passing on crafted data

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-hub-db-migration-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Serverless openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Fuse 7 io.apicurio-apicurito, io.syndesis-syndesis-parent
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-extensions-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9 Red Hat streams for Apache Kafka 2 com.github.streamshub-console Red Hat streams for Apache Kafka 3 com.github.streamshub-console
    affected: workaround, no fix available
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine
    fixed: vendor fix RHSA-2025:23528
  • Red Hat multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/cluster-api-rhel9 v2.7.6-3
    fixed: vendor fix RHSA-2025:18278
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1765829333
    fixed: vendor fix RHSA-2026:0722
show 23 more
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine
    fixed: vendor fix RHSA-2025:19332
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2, rhacm2/acm-grafana-rhel9 1783578847
    fixed: vendor fix RHSA-2026:41064
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/memcached-rhel9 v2.12.5-3
    fixed: vendor fix RHSA-2025:18744
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1768001980
    fixed: vendor fix RHSA-2026:0627
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2
    fixed: vendor fix RHSA-2025:19335
  • Red Hat Developer Hub 1.6 rhdh 1.6.4-1756241191
    fixed: vendor fix RHSA-2025:14767
  • Red Hat Developer Hub 1.7 rhdh 1.7.1-1757963043
    fixed: vendor fix RHSA-2025:16020
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 devspaces 3.23-1756509551, devspaces 3.23-1757019057, devspaces 3.23-1757618807
    fixed: vendor fix RHSA-2025:15847
  • Red Hat OpenShift Pipelines 1.15 openshift-pipelines 1771425314, openshift-pipelines 1771964224, openshift-pipelines 1772036471
    fixed: vendor fix RHSA-2026:3710
  • Red Hat OpenShift Pipelines 1.19 openshift-pipelines v1.19.4-1764818880
    fixed: vendor fix RHSA-2025:22905
  • Red Hat Trusted Artifact Signer 1.2 rhtas 1.2.1-1755456740
    fixed: vendor fix RHSA-2025:14474
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1765517627, multicluster-engine 1765517785, multicluster-engine 1765522347, multicluster-engine 1765522349, multicluster-engine 1765669648, multicluster-engine 1765755875, +20 more Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine
    not affected: vulnerable code not present
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8
    not affected: component not present
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2, rhacm2/thanos-rhel9 1784105699, rhacm2/console-rhel9 1783350952, rhacm2/prometheus-rhel9 1784022042, rhacm2/acm-search-v2-rhel9 1783327407, rhacm2/node-exporter-rhel9 1784018382, +35 more
    not affected: vulnerable code not present
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1767311055, rhacm2 1767311056, rhacm2 1767397077, rhacm2 1767397082, rhacm2 1767397328, rhacm2 1767397377, +38 more
    not affected: vulnerable code not present RHSA-2026:0627
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2
    not affected: vulnerable code not present
  • Red Hat Developer Hub 1 rhdh/rhdh-rhel9-operator
    not affected: component not present
  • Red Hat Developer Hub 1.6 rhdh 1.6.4-1756218204, rhdh 1.6.4-1756244632 Red Hat Developer Hub 1.7 rhdh 1.7.1-1757949497, rhdh 1.7.1-1757967808
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 7 polkit, firefox, thunderbird
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux 8 pcs, polkit, grafana, mozjs60, pcs-snmp, polkit-libs, +13 more
    not affected: component not present
  • Red Hat Enterprise Linux 9 gjs, pcs, polkit, pcs-snmp, polkit-libs
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-data-science-pipelines-argo-argoexec-rhel8, rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8
    not affected: component not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9, devspaces/dashboard-rhel8, devspaces/configbump-rhel9, devspaces/imagepuller-rhel9, devspaces-tech-preview/idea-rhel9, devspaces/devspaces-rhel9-operator, +1 more Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 devspaces 3.23-1756504388, devspaces 3.23-1756506343, devspaces 3.23-1756507311, devspaces 3.23-1756753588, devspaces 3.23-1756828766, devspaces 3.23-1757017659, +6 more
    not affected: vulnerable code not present

4 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/browserify/sha.js/security/advisories/GHSA-95m3-7q98-8xr5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm sha.js
<2.4.12
2.4.12

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.