CVE-2025-29774: xml-crypto XML Signature Verification Bypass Vulnerability
Summary
CVE-2025-29774: xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References. Affects xml-crypto across 3 version ranges.
< 2.1.6
>= 3.0.0, < 3.2.1
>= 4.0.0, < 6.0.1
Fixed in 2.1.6, 3.2.1 or 6.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xml-crypto is an open-source library used for XML digital signatures in Node.js applications. It provides functionalities to create and verify XML signatures, ensuring the integrity and authenticity of XML documents. However, the library is vulnerable to a critical issue that allows attackers to bypass signature verification, potentially compromising the security of systems relying on it.
Vulnerability Detail
The vulnerability in xml-crypto arises from its handling of XML Signature elements, specifically allowing multiple SignedInfo nodes within a single Signature. This flaw can be exploited by attackers to modify signed XML messages in a way that still passes signature verification checks. As a result, an attacker could alter critical identity or access control attributes, enabling privilege escalation or user impersonation. The vulnerability affects all versions of xml-crypto up to and including 6.0.0.
How To Fix
Latest published version: 6.4.0 as of 23 Oct 2026
npm install xml-crypto@6.4.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.62.1.6npm install xml-crypto@2.1.6 -
>= 3.0.0, < 3.2.13.2.1npm install xml-crypto@3.2.1 -
>= 4.0.0, < 6.0.16.0.1npm install xml-crypto@6.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, you can implement a check in your code to ensure that there is only one SignedInfo node per Signature. Use the following code snippet to validate the SignedInfo nodes:
const signedInfoNodes = xpath.select(".//*[local-name(.)='SignedInfo']", signatureNode);
if (signedInfoNodes.length === 0) {
// Not necessarily a compromise, but invalid. Should contain exactly one SignedInfo node
}
if (signedInfoNodes.length > 1) {
// Compromise detected, take appropriate action
}
Conclusion
The xml-crypto library has a critical vulnerability that allows for XML Signature Verification Bypass, posing significant security risks. It is essential to upgrade to the patched versions to safeguard your applications. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for xml-crypto →
FAQ
The vulnerability allows attackers to bypass authentication and authorization mechanisms, potentially leading to privilege escalation or user impersonation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
All versions of xml-crypto up to and including 6.0.0 are affected. Versions 2.x and 3.x also have specific patched versions.
You can upgrade xml-crypto using npm with the command: npm install xml-crypto@6.0.1 for version 6.x, or the respective patched versions for 2.x and 3.x.
Implement a check in your code to ensure that there is only one SignedInfo node per Signature to mitigate the risk until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for xml-crypto.
