CVE-2025-6545: 
JavaScript vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-6545) has been identified in pbkdf2, affecting versions from 3.0.10 through 3.1.2. The vulnerability is related to improper input validation in the lib/to-buffer.js file, which allows signature spoofing through improper validation. The issue was discovered and disclosed on June 23, 2025 (NVD, GitHub Advisory).

The vulnerability stems from improper input validation that affects both unsupported algorithms (e.g., sha3-256, sha3-512, sha512-256) and supported but non-normalized algorithms (e.g., Sha256, Sha512, SHA1). In Node.js environments (with pbkdf2/browser import) and Bun environments, the vulnerability results in uninitialized memory being returned as Buffer.allocUnsafe is used. In browser environments, it returns zero-filled buffers, which are completely unacceptable as KDF output. The vulnerability has been assigned a CVSS v4.0 score of 9.1 (Critical) with the vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H (GitHub Advisory).

The vulnerability's impact is critical as it can cause browserified code to silently generate zero-filled keys instead of proper ones, even for code that was previously working in Node.js or test environments. This affects require('crypto') in polyfilled mode, bundled code using Webpack/Vite, and specific implementations in Node.js and Bun environments. The vulnerability compromises cryptographic operations by returning predictable or uninitialized memory instead of secure cryptographic output (GitHub Advisory, Wiz).

The vulnerability has been patched in version 3.1.3 and later. However, simply updating to a fixed version may not be sufficient. Users need to review and take action if they were using pbkdf2 library through crypto-browserify or directly with algorithms not from the literal string list. When targeting non-Node.js environments, it is recommended to avoid Node.js crypto polyfill entirely and instead use crypto.subtle and/or modern/audited cryptography primitives (GitHub Advisory).