CVE-2025-27611 base-x homograph attack allows Unicode lookalike characters to bypass validation.
Attackers can use Unicode lookalike characters to bypass validation, potentially deceiving users into sending funds to unintended addresses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27611?
CVE-2025-27611 is a high-severity vulnerability in cryptocoinjs base-x, published on 30 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1.
Weakness: CWE-1007
Which versions are affected by CVE-2025-27611?
6 open source packages ship an affected version, including base-x.
| Package | Affected | Fixed in |
|---|---|---|
base-x npm | All versions | 3.0.11 |
base-x npm | All versions | 3.0.11 |
base-x npm | From 4.0.0 | 4.0.1 |
base-x npm | From 4.0.0 | 4.0.1 |
base-x npm | From 5.0.0 | 5.0.1 |
base-x npm | From 5.0.0 | 5.0.1 |
How do I fix CVE-2025-27611?
Upgrade base-x to a fixed version for your release line: 3.0.11, 4.0.1 or 5.0.1.
Is CVE-2025-27611 being exploited?
There is no known exploitation of CVE-2025-27611 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1791197262, GHSA-xq7p-g2vc-g82p.