CVE-2025-9288

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

Score

CVSS 4.0 9.1 Critical

Status

Modified - 7ffcee3d-2c14-4c3e-b844-86c6a321a158

Published

2025-08-20

Last modified

2025-11-03

Weaknesses

CWE-20

Affected products

• Sha.js (Browserify)

References

• https://github.com/browserify/sha.js/pull/78
• https://github.com/browserify/sha.js/security/advisories/GHSA-95m3-7q98-8xr5
• https://www.cve.org/CVERecord?id=CVE-2025-9287
• https://lists.debian.org/debian-lts-announce/2025/09/msg00016.html