CVE-2025-25298: Strapi password hashing missing maximum length validation

CVE-2025-25298 · Severity: medium · CVSS 4 · Published 2025-10-16

Strapi is an open-source headless CMS that manages user authentication and password storage. The password hashing mechanism using bcryptjs fails to validate maximum password length, allowing users to set passwords exceeding 72 bytes that get silently truncated. An attacker could potentially bypass authentication by logging in with only the first 72 characters of a longer password, and long passwords can degrade server performance.

Technologies: @strapi/core (npm). Vendors: npm.

Quick answers

Is CVE-2025-25298 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-25298 being exploited in the wild.
How severe is CVE-2025-25298?
Medium severity, with a CVSS score of 4, published 16 October 2025.
Which products and versions are affected?
@strapi/core (npm) SEMVER:introduced=0,fixed=5.10.3.
Is there a fix for CVE-2025-25298?
Yes. @strapi/core (npm): upgrade to 5.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-25298 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-25298?
Check whether you run @strapi/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @strapi/core (npm): upgrade to 5.10.3 or later
    npm install @strapi/core@5.10.3

Technical details

The vulnerability is a weak encoding weakness (CWE-261) in Strapi's user authentication system. The root cause is that Strapi's password hashing implementation using bcryptjs does not enforce a maximum password length validation, despite bcryptjs only considering the first 72 bytes of any password. This allows users to set passwords longer than 72 bytes, which are silently truncated during hashing. An attacker can exploit this by creating a user account with a long password (e.g., 85 characters) and then authenticating using only the first 72 characters, which will successfully match the truncated hash. No authentication is required to create a user account with a vulnerable password length. The fix, deployed in version 5.10.3, adds byte-length validation to enforce a maximum of 72 bytes during password creation and updates, and properly calculates byte length using TextEncoder to account for multi-byte UTF-8 characters.

Affected products

  • Strapi @strapi/core all versions before 5.10.3

Identifiers

  • CVE-2025-25298
  • GHSA-2cjv-6wg9-f4f3

Timeline

  • 2025-10-16: disclosed: Vulnerability published in GHSA-2cjv-6wg9-f4f3
  • 2025-01-23: patched: Fix commit 41f8cdf applied, enforcing 72-byte maximum for password creation and updates

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.