CVE-2025-9287 Missing type checks leading to hash rewind and passing on crafted data
Attackers can manipulate input data in the cipher-base library due to missing type checks, potentially altering cryptographic operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9287?
CVE-2025-9287 is a critical vulnerability in browserify:cipher-base, published on 20 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.
Weakness: CWE-20
Which versions are affected by CVE-2025-9287?
2 open source packages ship an affected version, including cipher-base. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cipher-base npm | All versions | 1.0.5 |
cipher-base npm | All versions | 1.0.5 |
Linux distribution packages (1)
python-bqplot openSUSE:Tumbleweed | All versions | 0.12.45-12.1 |
Products include Browserify Cipher-Base.
How do I fix CVE-2025-9287?
Upgrade cipher-base to 1.0.5 or later.
Is CVE-2025-9287 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9287 exists.
Sources
Also known as CLSA-2026-1779670116, DEBIAN-CVE-2025-9287, DLA-4291-1, DSA-5986-1, GHSA-cpq7-6gpm-g9rc, ROOT-APP-NPM-CVE-2025-9287 and 3 more.