Executive brief
The pbkdf2 npm library is a cryptographic key derivation utility used by applications to securely generate encryption keys from passwords. On older Node.js versions (0.12–2.x), when given Uint8Array input for passwords or salts, the library silently ignores the actual data and generates static, identical keys instead of proper unique keys. This completely undermines the security of any application using this library on those Node versions, as the same weak key would be used regardless of input, leaving encrypted data vulnerable to attacks.
Technical details
The pbkdf2 library contains a bug in its toBuffer conversion method that causes Uint8Array inputs to be silently disregarded on Node.js versions prior to 3.0.0. Instead of processing the supplied password and salt from Uint8Array objects, the function treats them as empty/undefined data, causing all calls to produce identical static hash output (the hash of empty password and salt). The vulnerability affects versions 1.0.0 through 3.1.2. The root cause is improper type conversion in the toBuffer method when handling typed arrays. While the library claims to support Node.js ≥0.12 and Uint8Array input (error messages even reference typed arrays), it silently fails rather than rejecting unsupported inputs, allowing developers to unknowingly generate weak, predictable cryptographic keys. The issue is fixed in version 3.1.3.
Affected products
- browserify pbkdf2 1.0.0 through 3.1.2
Timeline
- 2025-06-23: disclosed
- 2025-06-23: patched: Fixed in version 3.1.3