# CVE-2025-6547: pbkdf2 Uint8Array input handling produces static keys

Source: https://junglewise.ai/threats/cve-2025-6547-pbkdf2-uint8array-input-handling-produces-static-keys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-06-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-6547 · Severity: medium · CVSS 4 · Published 2025-06-23

The pbkdf2 npm library is a cryptographic key derivation utility used by applications to securely generate encryption keys from passwords. On older Node.js versions (0.12–2.x), when given Uint8Array input for passwords or salts, the library silently ignores the actual data and generates static, identical keys instead of proper unique keys. This completely undermines the security of any application using this library on those Node versions, as the same weak key would be used regardless of input, leaving encrypted data vulnerable to attacks.

Technologies: [pbkdf2 (npm)](https://junglewise.ai/threats/technologies/pbkdf2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-6547 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-6547 being exploited in the wild.

**How severe is CVE-2025-6547?** Medium severity, with a CVSS score of 4, published 23 June 2025.

**Which products and versions are affected?** pbkdf2 (npm) SEMVER:introduced=1.0.0,fixed=3.1.3.

**Is there a fix for CVE-2025-6547?** Yes. pbkdf2 (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-6547 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-6547?** Check whether you run pbkdf2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pbkdf2 (npm): upgrade to 3.1.3 or later

  ```sh
  npm install pbkdf2@3.1.3
  ```


## Technical details

The pbkdf2 library contains a bug in its toBuffer conversion method that causes Uint8Array inputs to be silently disregarded on Node.js versions prior to 3.0.0. Instead of processing the supplied password and salt from Uint8Array objects, the function treats them as empty/undefined data, causing all calls to produce identical static hash output (the hash of empty password and salt). The vulnerability affects versions 1.0.0 through 3.1.2. The root cause is improper type conversion in the toBuffer method when handling typed arrays. While the library claims to support Node.js ≥0.12 and Uint8Array input (error messages even reference typed arrays), it silently fails rather than rejecting unsupported inputs, allowing developers to unknowingly generate weak, predictable cryptographic keys. The issue is fixed in version 3.1.3.

## Affected products

- browserify pbkdf2 1.0.0 through 3.1.2

## Identifiers

- CVE-2025-6547
- GHSA-v62p-rq8g-8h59

## Timeline

- 2025-06-23: disclosed
- 2025-06-23: patched: Fixed in version 3.1.3

## References

- [https://github.com/browserify/pbkdf2/security/advisories/GHSA-v62p-rq8g-8h59](https://github.com/browserify/pbkdf2/security/advisories/GHSA-v62p-rq8g-8h59)

## Related threats

- [pbkdf2 rehashes long passwords on every iteration, enabling denial of service](https://junglewise.ai/threats/cve-2026-102414-pbkdf2-through-3-1-6-re-hashes-passwords-longer-than-the-digest)
- [pbkdf2 cryptographic library returns predictable zero-filled output for non-normalized algorithms](https://junglewise.ai/threats/cve-2025-6545-pbkdf2-cryptographic-library-returns-predictable-zero-filled)