Product

debian/node-sha.js vulnerabilities

3 published CVES affecting debian/node-sha.js, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 3
Critical: 1
High: 0
Medium: 0
Low: 0
Unscored: 2
CISA KEV: 0

Latest debian/node-sha.js CVEs

Newest publication first

DSA-6002-1 node-sha.js - security update
Published 2025-09-16

Unknown
DLA-4302-1 node-sha.js - security update
Published 2025-09-16

Unknown
CVE-2025-9288 Missing type checks leading to hash rewind and passing on crafted data
Published 2025-08-20

CriticalCVSS 9.1

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.