[Pkg-javascript-devel] Bug#1111772: node-cipher-base: CVE-2025-9287

[Salvatore Bonaccorso]

Source: node-cipher-base
Version: 1.0.4-6
Severity: grave
Tags: security upstream
Forwarded: https://github.com/browserify/cipher-base/pull/23
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-cipher-base.

CVE-2025-9287[0]:
| Improper Input Validation vulnerability in cipher-base allows Input
| Data Manipulation.This issue affects cipher-base: through 1.0.4.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-9287
    https://www.cve.org/CVERecord?id=CVE-2025-9287
[1] https://github.com/browserify/cipher-base/pull/23
[2] https://github.com/browserify/cipher-base/security/advisories/GHSA-cpq7-6gpm-g9rc
[3] https://github.com/browserify/cipher-base/commit/8fd136432ca298a664f5637629cf2b42a6c7f294

Regards,
Salvatore