CVE-2026-102414: pbkdf2 Denial of Service Vulnerability Due to Long Password Rehashing
Summary
CVE-2026-102414: pbkdf2 rehashes long passwords on every iteration, enabling denial of service. Affects pbkdf2 versions < 3.1.7. Fixed in 3.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pbkdf2 package is a widely used library in the Node.js ecosystem for implementing the PBKDF2 key derivation function, which is essential for securely hashing passwords. It provides a way to derive cryptographic keys from passwords, making it a critical component in applications that require secure user authentication. However, this package has a vulnerability that allows long passwords to cause a denial of service (DoS) by rehashing the password on every iteration, leading to performance degradation.
Vulnerability Detail
The vulnerability arises from the way the pbkdf2 package handles long passwords. Specifically, it does not utilize cached HMAC, enforce length limits, or pre-hash passwords that exceed the block size of the hash function, as specified in the HMAC standard. This oversight means that when a long password is processed, the package hashes the entire password for each iteration, significantly increasing the time required for key generation. This can lead to a denial of service, as an attacker could exploit this behavior by submitting excessively long passwords, causing the application to become unresponsive.
How To Fix
Minimum fixed version
3.1.7
This is the first release that contains the fix.
npm install pbkdf2@3.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing input validation to restrict the length of passwords accepted by your application. For example, you can limit passwords to a maximum of 256 characters to mitigate the risk of this vulnerability.
Conclusion
The pbkdf2 package has a vulnerability that allows denial of service through the rehashing of long passwords. It is crucial to update to version 3.1.7 or later to mitigate this risk. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for pbkdf2 →
FAQ
The vulnerability can lead to a denial of service (DoS) by allowing an attacker to submit long passwords, which causes the application to become unresponsive due to excessive processing time.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Without requiring access to the code or installation, it uses package-lock.json to identify vulnerabilities. You can also check your application using the Vulert playground.
Versions of the pbkdf2 package up to and including 3.1.6 are affected by this vulnerability. The issue is resolved in version 3.1.7.
As a temporary measure, implement input validation to restrict the length of passwords accepted by your application, limiting them to a maximum of 256 characters.
The CVSS score of this vulnerability is 3.7, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pbkdf2.
