browserify/pbkdf2 Security Advisories | GitStock

medium2026-10-06

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

GHSA-477h-4r7f-fvrx · CVE-2026-102414

critical2025-06-23

pbkdf2 silently disregards Uint8Array input, returning static keys

GHSA-v62p-rq8g-8h59 · CVE-2025-6547

critical2025-06-23

pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos

GHSA-h7cp-r72f-jxh6 · CVE-2025-6545