npm cipher-base vulnerabilities

Latest npm cipher-base CVEs

Newest publication first

1. CVE-2025-9287 Missing type checks leading to hash rewind and passing on crafted data

   Published 2025-08-20

   Critical·CVSS 9.1 EPSS 0.58%

   Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.