CVE-2025-65849: Altcha Proof-of-Work obfuscation mode cryptanalytic break

December 8, 2025 (updated December 12, 2025)

A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction.

References

altcha.org/docs/v2/obfuscation
github.com/advisories/GHSA-mpmc-qchh-r9q8
github.com/altcha-org/altcha
github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts
github.com/eternal-flame-AD/altcha-deobfs
nvd.nist.gov/vuln/detail/CVE-2025-65849

Code Behaviors & Features

Detect and mitigate CVE-2025-65849 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →