# CVE-2026-102414: pbkdf2 rehashes long passwords on every iteration, enabling denial of service

Source: https://junglewise.ai/threats/cve-2026-102414-pbkdf2-through-3-1-6-re-hashes-passwords-longer-than-the-digest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102414 · Severity: low · CVSS 3.7 · Published 2026-09-29

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on every iteration, and HMAC hashes such keys in full each time. Cost is therefore O(iterations × password length), and a long password can block the event loop. The fallback is used by pbkdf2Sync and pbkdf2 on Node.js before 0.12, on Bun (1.0.0 through 1.1.34, and 1.2.6 and later), and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library's feature check. It is also used when lib/sync.js is imported directly. Node.js 0.12 and later, and browser builds (which use lib/sync-browser.js), are not affected. Applications that enforce a reasonable maximum password length are not meaningfully affected.

Technologies: [pbkdf2 (npm)](https://junglewise.ai/threats/technologies/pbkdf2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-102414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102414 being exploited in the wild.

**How severe is CVE-2026-102414?** Low severity, with a CVSS score of 3.7, published 29 September 2026.

**Which products and versions are affected?** pbkdf2 (npm) <= 3.1.6, SEMVER:introduced=0,fixed=3.1.7.

**Is there a fix for CVE-2026-102414?** Yes. pbkdf2 (npm): upgrade to 3.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-102414?** Check whether you run pbkdf2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pbkdf2 (npm): upgrade to 3.1.7 or later

  ```sh
  npm install pbkdf2@3.1.7
  ```


## Affected products

- pbkdf2 (npm) <= 3.1.6, SEMVER:introduced=0,fixed=3.1.7

## Identifiers

- CVE-2026-102414
- GHSA-477h-4r7f-fvrx

## Related threats

- [pbkdf2 Uint8Array input handling produces static keys](https://junglewise.ai/threats/cve-2025-6547-pbkdf2-uint8array-input-handling-produces-static-keys)
- [pbkdf2 cryptographic library returns predictable zero-filled output for non-normalized algorithms](https://junglewise.ai/threats/cve-2025-6545-pbkdf2-cryptographic-library-returns-predictable-zero-filled)