Security vulnerabilities and automated fixes for key derivation issues
1 post found
A critical vulnerability (CVE-2025-6545) in pbkdf2 version 3.1.2 caused the library to silently return predictable key material instead of cryptographically secure keys. This Node.js dependency issue was discovered in the website/package-lock.json file and fixed by upgrading to pbkdf2 3.1.3, preventing potential authentication bypass and data exposure in production systems.