Name of the Vulnerable Software and Affected Versions:

pbkdf2 versions 3.0.10 through 3.1.2

Description:

The issue is related to an Improper Input Validation vulnerability in pbkdf2, allowing Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.js. The vulnerability is caused by the silent return of predictable uninitialized or zero-filled memory for non-normalized or unimplemented algorithms supported by Node.js.

Recommendations:

For versions 3.0.10 through 3.1.2, update to a version that fixes the Improper Input Validation vulnerability to prevent Signature Spoofing.

As a temporary workaround, consider restricting the use of non-normalized or unimplemented algorithms supported by Node.js until a patch is available.