CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service
Attackers can cause denial of service by submitting long passwords to pbkdf2, forcing expensive re-hashing on every iteration in specific JavaScript environments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102414?
CVE-2026-102414 is a medium-severity denial of service vulnerability in browserify pbkdf2, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on every iteration, and HMAC hashes such keys in full each time. Cost is therefore O(iterations × password length), and a long password can block the event loop. The fallback is used by pbkdf2Sync and pbkdf2 on Node.js before 0.12, on Bun (1.0.0 through 1.1.34, and 1.2.6 and later), and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library's feature check. It is also used when lib/sync.js is imported directly. Node.js 0.12 and later, and browser builds (which use lib/sync-browser.js), are not affected. Applications that enforce a reasonable maximum password length are not meaningfully affected.
Weakness: CWE-400
Which versions are affected by CVE-2026-102414?
2 open source packages ship an affected version, including pbkdf2.
| Package | Affected | Fixed in |
|---|---|---|
pbkdf2 npm | All versions | 3.1.7 |
pbkdf2 npm | All versions | 3.1.7 |
How do I fix CVE-2026-102414?
Upgrade pbkdf2 to 3.1.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-102414 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102414 exists.
Sources
Also known as CLSA-2026-1793205450, DEBIAN-CVE-2026-102414, GHSA-477h-4r7f-fvrx, MINI-2hv7-3cj6-p8hp, MINI-5q58-6wp2-pgff, MINI-5vvx-m35x-c4pj and 3 more.