Platform
nodejs
Component
pbkdf2
Fixed in
1.0.1
3.1.3
CVE-2025-6547 is a critical vulnerability affecting historic, yet still supported, versions of Node.js (0.12 - 2.x). This flaw resides within the pbkdf2 module, where it silently disregards Uint8Array input, potentially weakening password hashing. Affected versions include Node.js releases prior to 3.1.3, and a fix has been released.
The core impact of CVE-2025-6547 lies in the potential for significantly weakened password hashing. When pbkdf2 silently accepts Uint8Array input instead of the expected string or buffer, it bypasses crucial type checking and validation. This can lead to the use of shorter, less secure hashes, making password cracking substantially easier. Attackers could exploit this vulnerability to compromise user accounts and gain unauthorized access to sensitive data. The silent nature of the bypass makes detection difficult without specific monitoring.
CVE-2025-6547 has been publicly disclosed and is considered a high-probability exploit due to the ease of exploitation and the potential impact. There are currently no known active campaigns targeting this vulnerability, but the availability of the public disclosure increases the risk of exploitation. This CVE was added to the CISA KEV catalog on an unspecified date.
Exploit Status
EPSS
0.03% (9% percentile)
CISA SSVC
The primary mitigation for CVE-2025-6547 is to upgrade to Node.js version 3.1.3 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing stricter input validation within your application code to ensure that pbkdf2 only receives string or buffer inputs. While a WAF cannot directly address this vulnerability, it can help detect and block malicious requests attempting to exploit it. There are no specific Sigma or YARA rules available for this vulnerability at this time.
Update the pbkdf2 dependency to a version later than 3.1.2. This will fix the incorrect input validation vulnerability. See advisory GHSA-v62p-rq8g-8h59 for more details.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-6547 is a critical vulnerability in Node.js versions below 3.1.3 where the pbkdf2 module silently accepts Uint8Array input, weakening password hashing.
You are affected if you are using Node.js versions 0.12 through 2.x. Check your Node.js version with node -v.
Upgrade to Node.js version 3.1.3 or later to resolve this vulnerability. Ensure your dependencies are also up-to-date.
While there are no confirmed active campaigns, the public disclosure increases the risk of exploitation. Monitor your systems closely.
Refer to the Node.js security advisories at https://nodejs.org/en/security/ for the latest information and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.