cipher-base is missing type checks, leading to hash rewind and passing on crafted data

The core of the vulnerability lies in the create-hash function's lack of robust input validation. Instead of strictly enforcing strings or Buffer objects, the function accepts other data types. An attacker can craft malicious input that, when processed by the hashing algorithm, causes the internal state of the hash object to become corrupted. This corruption can manifest as application hangs, unexpected errors, or, more critically, the ability to rewind the hash state, effectively allowing an attacker to manipulate the resulting hash value. This could be exploited to bypass integrity checks, forge digital signatures, or compromise the security of any application relying on the affected hashing functions. The impact extends beyond just create-hash; packages like create-hmac and others that depend on this polyfill are also vulnerable.

Applications built with Node.js that utilize the create-hash package or any of its dependent libraries (e.g., crypto-browserify) are at risk. This includes web applications, desktop applications, and command-line tools. Projects using older versions of npm or those with lax dependency management practices are particularly vulnerable.

• nodejs / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*node*'} | Select-Object Name, Id

• nodejs / supply-chain:

Get-ChildItem -Path Env:NODE_PATH -Recurse | Where-Object {$_.Name -like '*create-hash*'}

• generic web: Inspect npm package.json files for dependencies on vulnerable versions of create-hash (prior to 1.0.5). Use npm ls create-hash to identify vulnerable dependencies in your project.

1. 2025-08-21Disclosure

   disclosure

2. 2025-08-21PoC

   poc

1. आरक्षित2025-08-20
2. प्रकाशित2025-08-21
3. संशोधित2026-03-16
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-9287 is to upgrade the create-hash package and its dependencies to version 1.0.5 or higher. This version includes the necessary input validation to prevent the vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by validating the input type before passing it to the createHash function. This could involve checking if the input is a string or a Buffer object. While not a complete solution, this can reduce the attack surface. There are no specific WAF or proxy rules that can directly address this vulnerability, as it occurs within the application code. Monitor npm package dependencies for updates and security advisories.

अंतिम अपडेट

1.0.78 महीने पहले