1
Critical Key Derivation Flaws in pbkdf2 Affect Millions of JavaScript Projects, PoC Available
(securityonline.info)
Paywalled.
this post was submitted on 24 Jun 2025
1 points (100.0% liked)
Cybersecurity
10466 readers
17 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
founded 3 years ago
MODERATORS
Sorry. It was not paywalled for me when I first saw. More info from different source: https://feedly.com/cve/CVE-2025-6545
Summary copy pasta
A critical vulnerability in the pbkdf2 library affecting versions 3.0.10 through 3.1.2. The vulnerability involves improper input validation that can cause browserifying code to silently generate zero-filled cryptographic keys instead of proper ones, particularly when used in environments different from Node.js or test settings.
So pretty bad. 8.1 out of ten for setting your crypto keys to match the US nuclear arsenal in the 80s