PT-2025-34165 · Sha.Js+3 · Sha.Js+3

Chalker · Published 2025-08-20 · Updated 2026-03-16 · CVE-2025-9288

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions sha.js versions through 2.4.11

Description An improper input validation vulnerability exists in sha.js, allowing for input data manipulation. This flaw can lead to hash collisions and potentially private key extraction, threatening web applications. The vulnerability stems from missing input type checks, which permit the use of data types other than expected, resulting in undefined behavior, including hash state rewinding and the potential to transform tagged hashes into untagged hashes. Exploitation can involve manipulating the length property of input data to generate collisions or cause denial-of-service conditions.

Recommendations Update sha.js to version 2.4.12 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

AZL-66570

CVE-2025-9288

DLA-4302-1

DSA-6002-1

GHSA-95M3-7Q98-8XR5

USN-7778-1

Affected Products

Debian

Linuxmint

Ubuntu

Sha.Js

References · 38

• 🔥 https://github.com/browserify/sha.js/security/advisories/GHSA-95m3-7q98-8xr5 · Exploit
• https://github.com/browserify/sha.js/pull/78 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-9288 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-9288 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-9288 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-9288 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-9288 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6002-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7778-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7778-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4302-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-66570 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-9288 · Security Note
• https://ubuntu.com/security/CVE-2025-9288 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-95m3-7q98-8xr5 · Vendor Advisory