PT-2025-42486 · Strapi+1 · @Strapi/Core+2

Published 2025-10-16 · Updated 2025-11-25 · CVE-2025-25298

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 5.10.3

Description Strapi, an open source headless CMS, has an issue where the @strapi/core package does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs truncates passwords exceeding 72 bytes, silently reducing the effective entropy of overlong passwords. This can mislead users and potentially allow authentication with only a portion of the password. Long inputs can also cause performance issues.

Recommendations Update to Strapi version 5.10.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-261

Related Identifiers

CVE-2025-25298

GHSA-2CJV-6WG9-F4F3

Affected Products

@Strapi/Core

Strapi

Bcryptjs

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25298.json · Exploit
• https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3 · Vendor Advisory
• https://github.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-25298 · Security Note
• https://osv.dev/vulnerability/GHSA-2cjv-6wg9-f4f3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25298 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://reddit.com/r/VulnMatter/comments/1o91x4z/resumen_diario_de_vulnerabilidades_17102025 · Reddit Post
• https://t.me/cveNotify/143964 · Telegram Post
• https://twitter.com/CVEnew/status/1978926583411851569 · Twitter Post