CVE-2025-65849: 
JavaScript vulnerability analysis and mitigation

CVE-2025-65849 is a cryptanalytic break in the Altcha Proof-of-Work (PoW) obfuscation mode, affecting the altcha npm package versions 0.8.0 through 2.2.4. The flaw allows remote, unauthenticated visitors to recover the PoW nonce in constant time via mathematical deduction, effectively bypassing the obfuscation mechanism entirely. It was disclosed on December 8, 2025, with the GitHub Advisory (GHSA-mpmc-qchh-r9q8) published the same day and reviewed on December 9, 2025. The NVD assigned a CVSS v3.1 base score of 9.1 (Critical), while the GitHub Advisory Database rates it Moderate (CVSS v4 score of 5.5) (Github Advisory, Feedly). The vendor disputes the severity, asserting the feature was never intended to provide cryptographic security against determined attackers (Github Advisory).

The vulnerability is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and stems from a fundamental misuse of AES-GCM symmetric encryption in the clarifyData function within src/helpers.ts (Altcha Source). The obfuscation scheme encrypts data using AES-GCM with a shared (or empty) key and an initialization vector (IV) derived from a random nonce; the client is expected to brute-force the IV to decrypt the data as a PoW exercise. However, because the encryption key is shared with the client and AES-GCM's properties allow the nonce/IV to be recovered mathematically without iterating through the full search space, an attacker can deduce the nonce in approximately two AES operations regardless of the configured cost factor (altcha-deobfs PoC). The researcher published a working Rust-based PoC (altcha-deobfs) demonstrating constant-time deobfuscation, recovering a nonce of 10,000,000,000 in approximately 7 milliseconds (altcha-deobfs PoC).

Successful exploitation allows any remote, unauthenticated party to trivially bypass the Altcha PoW obfuscation mechanism, recovering hidden nonce values and decrypting obfuscated data in constant time. This undermines the intended protection against automated scraping and bot activity, as the computational deterrent is rendered ineffective. The primary impact is confidentiality of obfuscated data (e.g., contact information or other content protected by the obfuscation feature) and integrity of the anti-bot mechanism, though availability is not directly affected (Github Advisory, altcha-deobfs PoC).

A public proof-of-concept tool (altcha-deobfs) is available on GitHub, demonstrating constant-time deobfuscation requiring only approximately two AES operations (altcha-deobfs PoC). GitHub's CNA-LR reviewed and adjudicated the CVE and associated GHSA entry as valid despite the vendor's post-hoc dispute. There is no evidence of in-the-wild exploitation or threat actor attribution at this time (Feedly). The EPSS score is approximately 0.017–0.021%, placing it in the 6th percentile for exploitation probability within 30 days, and it is not listed in the CISA KEV catalog (Github Advisory).

1. Identify target: Locate a web application using the altcha npm package (versions 0.8.0–2.2.4) with the obfuscation mode enabled, such as a contact form or page that uses Altcha's PoW obfuscation to hide data from scrapers.
2. Obtain obfuscated ciphertext: Retrieve the Base64-encoded AES-GCM ciphertext delivered to the browser by the target page (e.g., from the page's HTML or JavaScript).
3. Apply cryptanalytic deobfuscation: Use the public altcha-deobfs tool (or equivalent implementation) to exploit the AES-GCM nonce recovery weakness. Because the encryption key is shared (or empty by default) and the IV/nonce is placed in a non-confidential position relative to GCM's mode of operation, the nonce can be mathematically deduced in approximately two AES operations without brute-forcing the full search space.
4. Recover plaintext: The tool outputs the recovered nonce and decrypted plaintext in constant time (demonstrated at ~7ms for a nonce of 10,000,000,000), bypassing the intended PoW computational cost entirely (altcha-deobfs PoC).

As of the GitHub Advisory publication (December 8–12, 2025), no patched version of the altcha npm package has been identified — the advisory lists affected versions as >= 0.8.0 and <= 2.2.4 with no patched version specified (Github Advisory). Organizations relying on Altcha's obfuscation mode for protecting sensitive data should consider supplementing or replacing it with more robust anti-bot or access control mechanisms (e.g., server-side rate limiting, CAPTCHA alternatives, or authenticated endpoints). Monitor the official Altcha repository and GitHub Advisory for patch releases, and avoid using the obfuscation feature to protect genuinely sensitive information until a fix is available (Feedly).

The vendor (Altcha) retroactively disputed the CVE after disclosure, arguing the obfuscation feature was never intended to provide cryptographic security against determined attackers and that documentation explicitly states the goal is not a secure cryptographic algorithm (Github Advisory). The researcher (eternal-flame-AD) responded that the vendor failed to engage during the coordinated disclosure window (November 11–22, 2025) and that any reasonable user would expect the PoW mechanism to provide more than trivial encoding, publishing vendor notification emails publicly (altcha-deobfs PoC). GitHub's CNA-LR ultimately reviewed the dispute and adjudicated the CVE and GHSA entry as valid, adding a note that exploitation status is PoC only (altcha-deobfs PoC).