CVE-2025-29775: xml-crypto XML Signature Verification Bypass Vulnerability
Summary
CVE-2025-29775: xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment. Affects xml-crypto across 3 version ranges.
< 2.1.6
>= 3.0.0, < 3.2.1
>= 4.0.0, < 6.0.1
Fixed in 2.1.6, 3.2.1 or 6.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xml-crypto is a widely used library in the Node.js ecosystem that provides functionality for XML digital signatures and encryption. It allows developers to sign and verify XML documents, which is crucial for secure data exchange in various applications, particularly those involving authentication and authorization. However, xml-crypto has a critical vulnerability that can lead to serious security breaches if not addressed.
Vulnerability Detail
The vulnerability in xml-crypto allows an attacker to bypass XML signature verification by exploiting the presence of comments within the DigestValue element of a signed XML document. This can lead to unauthorized access or privilege escalation, as attackers can modify signed XML messages to alter critical attributes without detection. The issue arises from improper handling of comments in the DigestValue, which should not contain any comments. If an attacker successfully exploits this vulnerability, they can impersonate users or gain elevated privileges within the system.
How To Fix
Latest published version: 6.4.0 as of 23 Oct 2026
npm install xml-crypto@6.4.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.62.1.6npm install xml-crypto@2.1.6 -
>= 3.0.0, < 3.2.13.2.1npm install xml-crypto@3.2.1 -
>= 4.0.0, < 6.0.16.0.1npm install xml-crypto@6.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround involves checking for the presence of comments in the DigestValue. Below is a code snippet to help detect potential tampering:
const xpath = require('xpath');
const { DOMParser } = require('xmldom');
const decryptedDocument = ... // your implementation here
const digestValues = xpath.select(
"/*[local-name()='DigestValue'][count(node()) > 1]",
decryptedDocument,
);
if (digestValues.length > 0) {
// Compromise detected, implement your response here
}
Conclusion
The xml-crypto package has a critical vulnerability that can lead to severe security issues if not addressed. It is crucial to upgrade to the latest patched versions to ensure the integrity of XML signature verification. Additionally, using tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for xml-crypto →
FAQ
xml-crypto is used for signing and verifying XML documents, which is essential for secure data exchange in applications that require authentication and authorization.
CVE-2025-29775 allows attackers to bypass XML signature verification by manipulating the DigestValue element, potentially leading to unauthorized access or privilege escalation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Upgrade to xml-crypto version 6.0.1 or higher if using version 4.0.0 or lower. For version 2.x, upgrade to 2.1.6, and for version 3.x, upgrade to 3.2.1.
Implement the provided workaround to check for comments in the DigestValue to detect potential tampering until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for xml-crypto.
