CVE-2025-6545: 
JavaScript vulnerability analysis and mitigation

CVE-2025-6545 is a critical improper input validation vulnerability in the pbkdf2 npm package (versions 3.0.10 through 3.1.2) that causes the library to silently return predictable zero-filled or uninitialized memory instead of properly derived cryptographic key material when non-normalized or unsupported algorithm strings are supplied. The vulnerability was discovered and disclosed on June 23, 2025, with the advisory published by maintainer ljharb and reporter ChALkeR via the GitHub Security Advisory database. It carries a CVSS v4.0 base score of 9.1 (Critical) (Github Advisory, Feedly). Affected downstream products include IBM Rapid Infrastructure Automation, IBM Cloud Pak for Data, and IBM Knowledge Catalog (IBM Advisory).

The root cause is improper input validation (CWE-20) in the lib/to-buffer.js file of the pbkdf2 polyfill. When pbkdf2 or pbkdf2Sync is called with an algorithm string that is either unsupported (e.g., sha3-256, blake2b512) or a non-normalized variant of a supported algorithm (e.g., SHA1, sha-1, Sha256, sha-256), the library's internal HMAC implementation fails to recognize the algorithm and silently falls through, returning a buffer allocated with Buffer.allocUnsafe (uninitialized memory on Node.js/Bun) or a zero-filled buffer (in browser environments) rather than raising an error (Github Advisory). This behavior is triggered in polyfilled environments — including Webpack/Vite bundles using crypto-browserify, node-libs-browser, or vite-plugin-node-polyfills — and also affects Bun's top-level require('pbkdf2'). On standard Node.js, require('pbkdf2') is not affected, but require('pbkdf2/browser') is. A public proof-of-concept demonstrating the zero-output is included in the advisory itself (Github Advisory).

The primary impact is the silent generation of cryptographically weak key material — either all-zero buffers in browsers or uninitialized (potentially attacker-observable) memory in Bun/Node.js browser-import contexts — for any application using affected algorithm strings with the pbkdf2 polyfill. This completely undermines the security of any cryptographic operation relying on the derived key, enabling signature spoofing, authentication bypass, and unauthorized access to systems or data protected by those keys. Downstream systems using IBM Rapid Infrastructure Automation, IBM Cloud Pak for Data, and IBM Knowledge Catalog are also affected, broadening the potential impact to enterprise environments (Github Advisory, IBM Advisory). Critically, keys already generated during the vulnerable period remain compromised even after patching, requiring key rotation.

No public exploit code beyond the proof-of-concept included in the security advisory is known, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.08% (Feedly data) to 0.416% (GitHub Advisory Database), placing it in the 62nd percentile for exploitation probability within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation is passive in nature — an attacker who knows or can guess that a target application used a vulnerable algorithm string can predict the derived key (all zeros in browser environments) and use it to forge signatures or bypass authentication without any active network interaction against the vulnerable library itself.

1. Identify vulnerable applications: Determine if a target application uses the pbkdf2 npm package (versions 3.0.10–3.1.2) in a bundled/browser context (Webpack, Vite, etc.) or on Bun, and calls pbkdf2 or pbkdf2Sync with a non-normalized or unsupported algorithm string (e.g., SHA1, sha-1, sha-256, sha3-256, blake2b512).
2. Determine the algorithm string used: Review the application's source code, bundle, or dependencies (including transitive deps via crypto-browserify) to identify which algorithm string is passed to pbkdf2Sync/pbkdf2.
3. Predict the derived key: If the algorithm string is not one of the exact literals (md5, sha1, sha224, sha256, sha384, sha512, rmd160, ripemd160), the derived key in browser environments will be an all-zero buffer of the requested length. For example: pbkdf2Sync('secret', 'salt', 100000, 64, 'SHA1') returns 0000...0000 (128 hex chars).
4. Forge signatures or bypass authentication: Use the predicted zero-filled key to forge HMAC signatures, decrypt data, or authenticate to systems that rely on the compromised key material, depending on how the application uses the derived key (Github Advisory).

• Application Behavior: Authentication or signature verification succeeding with all-zero or trivially predictable key material; cryptographic operations not raising errors despite using non-standard algorithm strings.
• Dependency Audit: Presence of pbkdf2 npm package versions >=3.0.10 and <=3.1.2 in node_modules, package-lock.json, or yarn.lock; transitive inclusion via crypto-browserify, node-libs-browser, vite-plugin-node-polyfills, or node-stdlib-browser.
• Code Review: Calls to pbkdf2 or pbkdf2Sync (directly or via require('crypto') in polyfilled mode) with algorithm strings other than the exact literals: md5, sha1, sha224, sha256, sha384, sha512, rmd160, ripemd160.
• Key Material: Derived keys stored or transmitted that are all-zero hex strings (e.g., 0000000000000000...) of the expected key length.

Upgrade the pbkdf2 npm package to version 3.1.3 or later, which correctly validates algorithm strings and implements HMAC internally without relying on create-hmac for algorithm dispatch (Github Advisory, Red Hat Bugzilla). Upgrading alone is not sufficient: any cryptographic keys derived using a non-normalized or unsupported algorithm string during the vulnerable period must be considered compromised and should be regenerated. Organizations should audit all direct and transitive uses of pbkdf2 (including via crypto-browserify) in bundled or Bun environments, and prefer crypto.subtle or modern audited cryptographic primitives over Node.js crypto polyfills when targeting non-Node.js environments. IBM has released patches for affected products including IBM Rapid Infrastructure Automation and IBM Knowledge Catalog for IBM Cloud Pak for Data (IBM Advisory).

Red Hat triaged the vulnerability as high severity and opened a tracking bug with a broad CC list covering numerous product teams, indicating significant internal impact assessment (Red Hat Bugzilla). The advisory was authored by maintainer ljharb and credited reporter ChALkeR, both well-known figures in the Node.js/npm ecosystem. Fedora issued updates for yarnpkg packages to address the vulnerability, and SUSE/openSUSE issued similar updates for affected packages (Feedly). IBM issued multiple advisories covering affected enterprise products.