CVE-2025-69287: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69287 is a cryptographic signature data preparation vulnerability in the BSV Blockchain TypeScript SDK (@bsv/sdk) affecting all versions prior to 2.0.0. The flaw resides in the BRC-104 mutual authentication implementation within Peer.ts, causing incorrect signature data to be generated during peer authentication handshakes. It was published on February 17, 2026, with a patch released the same day. The CVSS v3.1 base score is 5.4 (Medium), though the advisory notes the cryptographic impact may be more severe in cross-SDK deployments (GitHub Advisory).

The root cause is classified as CWE-573 (Improper Following of Specification by Caller). In src/auth/Peer.ts, the processInitialRequest and processInitialResponse methods incorrectly prepared signature data by concatenating two base64-encoded nonce strings before decoding them (base64ToBytes(message.initialNonce + sessionNonce)). Because base64 padding characters (=) act as early termination signals for decoders, this produced only ~32–34 bytes of signature data instead of the required 64 bytes. The correct approach — decoding each nonce individually and then concatenating the resulting byte arrays — was introduced in the fix commit (GitHub Advisory, Fix Commit):

// Buggy (before fix)
data: Peer.base64ToBytes(message.initialNonce + sessionNonce)

// Fixed (after)
data: [
  ...Peer.base64ToBytes(message.initialNonce),
  ...Peer.base64ToBytes(sessionNonce)
]

The vulnerability breaks cross-SDK BRC-104 mutual authentication: TypeScript SDK clients produce cryptographic signatures that are incompatible with those expected by Go or Python SDK servers, causing authentication failures. In scenarios where authentication failures are silently ignored or improperly handled, an attacker could potentially bypass authentication checks entirely. Additionally, the mismatch can be leveraged for man-in-the-middle attacks or denial of service through repeated authentication failures, affecting the integrity and availability of peer-to-peer communication channels (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-69287. The EPSS score is approximately 0.046% (0.083% per GitHub Advisory), placing it in the 24th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction and is limited to environments where TypeScript SDK clients authenticate against Go or Python SDK servers using BRC-104 (GitHub Advisory).

1. Identify target environment: Locate a deployment where a TypeScript BRC-104 peer (using @bsv/sdk < 2.0.0) authenticates against a Go or Python BSV SDK server.
2. Intercept authentication handshake: Position as a network intermediary (man-in-the-middle) between the TypeScript client and the Go/Python server during the BRC-104 mutual authentication exchange.
3. Observe signature mismatch: The TypeScript client sends a signature computed over only ~32 bytes (truncated nonce data) instead of the expected 64 bytes, causing the server-side verification to fail.
4. Exploit failure handling: If the server or application layer silently ignores or improperly handles the authentication failure (e.g., falls back to an unauthenticated session), the attacker gains access without valid credentials.
5. Forge or replay: Alternatively, craft authentication messages that exploit the truncated signature space to forge valid-looking signatures against the weakened 32-byte data surface, depending on the server's verification logic (GitHub Advisory, ts-sdk Advisory).

• Network: Repeated BRC-104 authentication handshake failures between TypeScript clients and Go/Python SDK servers; unexpected session establishment following authentication errors.
• Logs: Server-side logs showing signature verification failures from TypeScript SDK clients (e.g., mismatched signature length — 32 bytes received vs. 64 bytes expected); authentication error messages in BRC-104 peer communication logs.
• Application Behavior: TypeScript SDK clients consistently failing to authenticate with non-TypeScript peers while same-language (TypeScript-to-TypeScript) authentication succeeds; unexpected fallback to unauthenticated sessions in peer-to-peer communication.

Upgrade the @bsv/sdk npm package to version 2.0.0 or later, which contains the fix applied in commit d8cf693 (Fix Commit). There are no documented configuration-based workarounds; upgrading is the only remediation. Organizations using cross-SDK BRC-104 authentication (TypeScript clients with Go or Python servers) should treat this as a priority upgrade to restore authentication integrity (GitHub Advisory).

The vulnerability was reported by security researcher F1r3Hydr4nt and published by repository maintainer sirdeggen on February 17, 2026. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (ts-sdk Advisory).