Executive brief
cipher-base is a JavaScript cryptographic library used as a polyfill for Node.js hash functions in browsers and other environments. Due to missing input validation, attackers can pass specially crafted non-Buffer objects that cause hash operations to rewind, generate collisions, or produce incorrect results. This could allow attackers to forge cryptographic signatures, extract private keys in downstream cryptography libraries, or bypass data integrity checks.
Technical details
The vulnerability is a missing input type validation flaw (CWE-20) in the cipher-base library used by create-hash, create-hmac, and crypto-browserify. Node.js crypto.createHash() only accepts strings, Buffers, TypedArrays, or DataViews, but cipher-base's polyfill does not enforce these checks. An attacker can supply crafted JavaScript objects with a `length` property (e.g., `{length: -32}` or `{length: '1e99'}`) to rewind the hash state, trigger denial of service, or generate hash collisions for different input data. The vulnerability is network-accessible when applications accept hashed data or cryptographic operations from untrusted sources. Patches are available in versions after 1.0.4.
Affected products
- browserify cipher-base <=1.0.4
Timeline
- 2025-08-20: disclosed: Vulnerability published to NVD
- 2025-08-21: advisory: GitHub advisory GHSA-cpq7-6gpm-g9rc published
- 2025-08-21: patched: Patch released in versions > 1.0.4