CVE-2025-6547: pbkdf2 silently disregards Uint8Array input, returning static keys

June 23, 2025 (updated February 17, 2026)

On historic but declared as supported Node.js versions (0.12-2.x), pbkdf2 silently disregards Uint8Array input

This only affects Node.js <3.0.0, but pbkdf2 claims to:

Support Node.js >= 0.12 (and there seems to be ongoing effort in this repo to maintain that)
Support Uint8Array input (input is typechecked against Uint8Array, and the error message includes e.g. “Password must be a string, a Buffer, a typed array or a DataView”

References

github.com/advisories/GHSA-v62p-rq8g-8h59
github.com/browserify/pbkdf2
github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb
github.com/browserify/pbkdf2/security/advisories/GHSA-v62p-rq8g-8h59
nvd.nist.gov/vuln/detail/CVE-2025-6547

Code Behaviors & Features

Detect and mitigate CVE-2025-6547 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →