Improper Input Validation in sha.js Package - CVE-2025-9288
Summary
CVE-2025-9288: Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. Affects node-sha.js versions < 105bfe57c69e13c83fcf7a6ca660dd984cb291bf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sha.js package is a widely used library for hashing data in JavaScript applications. It provides various cryptographic hash functions, enabling developers to securely handle data integrity. However, the package has been identified to have a vulnerability that allows for improper input validation, potentially leading to data manipulation.
Vulnerability Detail
CVE-2025-9288 is an improper input validation vulnerability found in the sha.js package, affecting versions up to 2.4.11. This flaw allows attackers to manipulate input data, which can lead to unexpected behavior or security breaches. The vulnerability originates from the way the package processes input, failing to adequately validate it before use, which can have serious implications for applications relying on this library for data integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that all input data is validated before being processed by the sha.js functions. This can be done by implementing additional checks in your application code to sanitize and validate input data.
Conclusion
The CVE-2025-9288 vulnerability in the sha.js package poses a significant risk due to improper input validation. It is crucial for developers to update to the latest version of the package and implement necessary input validation measures to protect their applications from potential data manipulation attacks.
See every vulnerability recorded for node-sha.js →
FAQ
CVE-2025-9288 is a vulnerability in the sha.js package that allows for improper input validation, leading to potential data manipulation.
The vulnerability affects sha.js versions up to 2.4.11.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include unauthorized data manipulation, which can compromise the integrity of applications relying on the sha.js library for hashing.
If an immediate update is not possible, implement input validation checks in your application to mitigate the risk until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-sha.js.
