Vulnerability-Lookup

GHSA-477H-4R7F-FVRX

Vulnerability from github – Published: 2026-10-06 13:40 – Updated: 2026-10-06 13:40

Summary

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

Details

Summary

This is the same bug as Django had (CVE-2013-1443).

Details

A long password can cause a DoS because it is not using cached HMAC, length limits, or pre-hashing passwords longer than the block size of the hash function as per HMAC spec. This line of code hashes the full password each iteration: https://github.com/browserify/pbkdf2/blob/1c3b1f526b052a29b3b42120c9821895772df7e8/lib/sync.js#L60

Also see https://github.com/browserify/pbkdf2/issues/82

PoC

The first key will take a lot longer to generate when not using the native code and uses code from /lib/sync.js (ie when this if statement is true): https://github.com/browserify/pbkdf2/blob/1c3b1f526b052a29b3b42120c9821895772df7e8/index.js#L33-L37

var pbkdf2 = require('pbkdf2');
var createHash = require('create-hash');
var pw = ".".repeat(1048576); // 1 MiB

var t0 = performance.now();
var key1 = pbkdf2.pbkdf2Sync(pw, "salt", 1000, 32, "sha256");
var t1 = performance.now();
pw = createHash('sha256').update(pw).digest(); // HMAC specification for keys larger than block size
var key2 = pbkdf2.pbkdf2Sync(pw, "salt", 1000, 32, "sha256");
var t2 = performance.now();

console.log("First took:  " + (t1 - t0));
console.log("Second took: " + (t2 - t1));
console.log("Generated keys:");
console.log(key1);
console.log(key2);

Impact

DoS

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "pbkdf2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-102414"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-06T13:40:10Z",
    "nvd_published_at": "2026-09-29T04:17:55Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThis is the same bug as Django had (CVE-2013-1443).\n\n### Details\nA long password can cause a DoS because it is not using cached HMAC, length limits, or pre-hashing passwords longer than the block size of the hash function as per HMAC spec. This line of code hashes the full password each iteration: https://github.com/browserify/pbkdf2/blob/1c3b1f526b052a29b3b42120c9821895772df7e8/lib/sync.js#L60\n\nAlso see https://github.com/browserify/pbkdf2/issues/82\n\n### PoC\nThe first key will take a lot longer to generate when not using the native code and uses code from `/lib/sync.js` (ie when this if statement is true):\nhttps://github.com/browserify/pbkdf2/blob/1c3b1f526b052a29b3b42120c9821895772df7e8/index.js#L33-L37\n\n```js\nvar pbkdf2 = require(\u0027pbkdf2\u0027);\nvar createHash = require(\u0027create-hash\u0027);\nvar pw = \".\".repeat(1048576); // 1 MiB\n\nvar t0 = performance.now();\nvar key1 = pbkdf2.pbkdf2Sync(pw, \"salt\", 1000, 32, \"sha256\");\nvar t1 = performance.now();\npw = createHash(\u0027sha256\u0027).update(pw).digest(); // HMAC specification for keys larger than block size\nvar key2 = pbkdf2.pbkdf2Sync(pw, \"salt\", 1000, 32, \"sha256\");\nvar t2 = performance.now();\n\nconsole.log(\"First took:  \" + (t1 - t0));\nconsole.log(\"Second took: \" + (t2 - t1));\nconsole.log(\"Generated keys:\");\nconsole.log(key1);\nconsole.log(key2);\n```\n\n### Impact\nDoS",
  "id": "GHSA-477h-4r7f-fvrx",
  "modified": "2026-10-06T13:40:10Z",
  "published": "2026-10-06T13:40:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/browserify/pbkdf2/security/advisories/GHSA-477h-4r7f-fvrx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102414"
    },
    {
      "type": "WEB",
      "url": "https://github.com/browserify/pbkdf2/issues/82"
    },
    {
      "type": "WEB",
      "url": "https://github.com/browserify/pbkdf2/commit/493d8d8ff437f680338bf7397398fda884ad462e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/browserify/pbkdf2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pbkdf2 rehashes long passwords on every iteration, enabling denial of service"
}

CVE-2026-102414 (GCVE-0-2026-102414)

Vulnerability from cvelistv5 – Published: 2026-09-29 03:42 – Updated: 2026-09-30 15:17

Title

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

Summary

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on every iteration, and HMAC hashes such keys in full each time. Cost is therefore O(iterations × password length), and a long password can block the event loop. The fallback is used by pbkdf2Sync and pbkdf2 on Node.js before 0.12, on Bun (1.0.0 through 1.1.34, and 1.2.6 and later), and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library's feature check. It is also used when lib/sync.js is imported directly. Node.js 0.12 and later, and browser builds (which use lib/sync-browser.js), are not affected. Applications that enforce a reasonable maximum password length are not meaningfully affected.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:16 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

harborist redhat root Scorecard

References

3 references

URL	Tags
https://github.com/browserify/pbkdf2/security/adv…	vendor-advisory
https://github.com/browserify/pbkdf2/issues/82	issue-tracking
https://github.com/browserify/pbkdf2/commit/493d8d8	patch

Impacted products

1 product

Vendor	Product	Version
browserify	pbkdf2	Affected: 0 , ≤ 3.1.6 (semver)

Credits

Steve Thomas (Sc00bz) Jordan Harband (ljharb)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102414",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:16:42.833185Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:17:17.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/browserify/pbkdf2/security/advisories/GHSA-477h-4r7f-fvrx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.npmjs.com",
          "defaultStatus": "unaffected",
          "packageName": "pbkdf2",
          "product": "pbkdf2",
          "programFiles": [
            "lib/sync.js"
          ],
          "programRoutines": [
            {
              "name": "pbkdf2Sync"
            },
            {
              "name": "pbkdf2"
            }
          ],
          "repo": "https://github.com/browserify/pbkdf2",
          "vendor": "browserify",
          "versions": [
            {
              "lessThanOrEqual": "3.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Steve Thomas (Sc00bz)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jordan Harband (ljharb)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003epbkdf2 through 3.1.6 re-hashes passwords longer than the digest\u0027s block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on every iteration, and HMAC hashes such keys in full each time. Cost is therefore O(iterations \u00d7 password length), and a long password can block the event loop. The fallback is used by pbkdf2Sync and pbkdf2 on Node.js before 0.12, on Bun (1.0.0 through 1.1.34, and 1.2.6 and later), and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library\u0027s feature check. It is also used when lib/sync.js is imported directly. Node.js 0.12 and later, and browser builds (which use lib/sync-browser.js), are not affected. Applications that enforce a reasonable maximum password length are not meaningfully affected.\u003c/p\u003e"
            }
          ],
          "value": "pbkdf2 through 3.1.6 re-hashes passwords longer than the digest\u0027s block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on every iteration, and HMAC hashes such keys in full each time. Cost is therefore O(iterations \u00d7 password length), and a long password can block the event loop. The fallback is used by pbkdf2Sync and pbkdf2 on Node.js before 0.12, on Bun (1.0.0 through 1.1.34, and 1.2.6 and later), and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library\u0027s feature check. It is also used when lib/sync.js is imported directly. Node.js 0.12 and later, and browser builds (which use lib/sync-browser.js), are not affected. Applications that enforce a reasonable maximum password length are not meaningfully affected."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T03:42:04.950Z",
        "orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
        "shortName": "harborist"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/browserify/pbkdf2/security/advisories/GHSA-477h-4r7f-fvrx"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/browserify/pbkdf2/issues/82"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/browserify/pbkdf2/commit/493d8d8"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to a version of pbkdf2 that includes the fix, which pre-hashes passwords longer than the digest block size once before iterating, or, enforce literally any reasonable maximum password length before calling pbkdf2.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to a version of pbkdf2 that includes the fix, which pre-hashes passwords longer than the digest block size once before iterating, or, enforce literally any reasonable maximum password length before calling pbkdf2."
        }
      ],
      "source": {
        "advisory": "GHSA-477h-4r7f-fvrx",
        "discovery": "EXTERNAL"
      },
      "title": "pbkdf2 rehashes long passwords on every iteration, enabling denial of service",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eEnforce a maximum password length (for example, 1024 bytes) before calling pbkdf2, or call the runtime\u0027s native crypto.pbkdf2Sync directly.\u003c/p\u003e"
            }
          ],
          "value": "Enforce a maximum password length (for example, 1024 bytes) before calling pbkdf2, or call the runtime\u0027s native crypto.pbkdf2Sync directly."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
    "assignerShortName": "harborist",
    "cveId": "CVE-2026-102414",
    "datePublished": "2026-09-29T03:42:04.950Z",
    "dateReserved": "2026-09-29T02:06:16.561Z",
    "dateUpdated": "2026-09-30T15:17:17.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-477H-4R7F-FVRX

Summary

Details

PoC

Impact

CVE-2026-102414 (GCVE-0-2026-102414)

Tags

Sightings

Nomenclature

Related by attack behaviour