CVE-2025-9288: browserify sha.js Improper Input Validation
CVSS: 9.1v4.0CriticalModified
AliasesUBUNTU-CVE-2025-9288USN-7778-1DEBIAN-CVE-2025-9288DLA-4302-1DSA-6002-1CGA-2rhx-c76j-9gcvCGA-592c-9gp6-j58hCGA-5r4f-p2p6-8p4pCGA-7229-qfcv-6qj9CGA-7786-8vp8-c5hwCGA-7mrm-w84r-vxmvCGA-7pf6-8vr8-wp5pCGA-8x28-qm68-w659CGA-94pf-g8gv-37hxCGA-9vpc-w7q5-h5vfCGA-c964-5jr6-q4xvCGA-f66r-2v9w-9rg8CGA-f6q8-378f-wch6CGA-ff73-2c8x-g497CGA-frrx-xq6m-c648CGA-g4hw-49r6-g5qgCGA-g4mq-g36p-x5f9CGA-gq2p-rrgf-75mwCGA-h6gc-jg5h-2gxcCGA-hj62-r499-vm3xCGA-hr5x-457x-545qCGA-jm43-c88r-q52xCGA-pcm7-882j-q54hCGA-qc4c-rxfr-g9chCGA-r2p9-r87h-hj38CGA-v5m6-9872-fc43CGA-wghj-4r36-cp64CGA-xfqq-4j47-735wGHSA-95m3-7q98-8xr5CGA-2v68-5cvf-xchjCGA-3765-67hc-fprfCGA-398f-crfx-9q4rCGA-3jr5-5493-fmj2CGA-3vq7-6xv7-cj6fCGA-3w94-c8xw-x42wCGA-487r-fh8m-32f8CGA-4grw-qfv4-hwwpCGA-4h94-2wmg-2mw2CGA-4p35-f46r-986gCGA-5cfm-2rhm-fxrpCGA-5chr-5gvg-78mhCGA-636c-4m62-36w8CGA-69c8-7gh5-p2wfCGA-6h62-6j96-8265CGA-6hfr-gpmw-mwf4CGA-6hpw-hgcm-c8hcCGA-6p3v-2pjh-7cr5CGA-6vvr-q6xg-mxx5CGA-7769-mmcg-cj4rCGA-7fqm-9643-wgvrCGA-7rfq-4p4v-3jcvCGA-7wrv-w92w-3p7vCGA-87f7-p7hg-p8w2CGA-8jg2-9685-3828CGA-94rg-vmrf-h8r9CGA-97pf-pvg2-4hv8CGA-97w3-4fw9-5q5pCGA-9w73-6256-f4r8CGA-c273-mxr3-v5pxCGA-c5r6-qqqc-q9c8CGA-cqr4-mxcp-cj4qCGA-cxj3-6c36-f4j2CGA-f3rv-5fvf-g83fCGA-fjjp-p6jq-mw8xCGA-fmwv-qcw6-x577CGA-fv46-wmgf-6xvpCGA-gqqg-q7g3-5448CGA-hcqv-4rj7-fm8vCGA-hwcg-33f2-5q89CGA-j8gf-pqm9-h7h4CGA-jgh3-hc4f-976wCGA-jm3g-h8h7-jhgfCGA-mh8g-v2p2-2x6hCGA-mqr5-cr2m-gx9rCGA-p2f5-f8x2-frj6CGA-pf5j-mh4g-g893CGA-pm9p-mvx2-8wcjCGA-px72-m6h7-mhghCGA-qfg3-388x-mp6hCGA-qfgh-qvq3-2824CGA-r4rm-54p7-m7mmCGA-r58g-6m5p-793xCGA-r875-w4xr-59fgCGA-r8r6-2237-87f5CGA-r8v8-4663-r9qfCGA-rfpw-5w76-v79cCGA-rfww-6j82-3vmfCGA-rggr-4vgv-2j5vCGA-rmmw-pfq6-gmghCGA-vm5m-fq9q-g5gqCGA-w2xq-j27m-j43mCGA-wgx2-3xw7-m5cxCGA-wmf7-472x-3499CGA-wmmp-4g67-3953CGA-x258-rh92-7mccCGA-x37p-9883-qcp4CGA-xhrw-4xxf-72fhCGA-xw3x-cw86-f7fcCGA-xwwq-j7fh-6xp6
Published 20-08-2025Last modified 03-11-2025
Vulnerability summary
CVE-2025-9288 is a critical (CVSS 9.1) Improper Input Validation vulnerability in browserify sha.js. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.1/10
010
Critical · v4.0 (CVE.org)EPSS score
0.71%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 20-08-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
CVSS metrics
10 scores · 7 sources · 2 versionsCritical 9.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N
- OSV · NpmEcosystem advisory · calculated9.1CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N
- NVDNIST9.1CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.1Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HSourcesAll 4 agree
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · NpmEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.03 pp
From 0.68% on 19-09-2026
19-09-202619-10-2026
EPSS score0.71%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSha.Js
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard49 products
- gitlab-rails-ce-18.1< 18.1.6-r15
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11< 18.11.6-r4
- gitlab-rails-ce-18.5All versions (No fix recorded)
- gitlab-rails-ce-18.6All versions (No fix recorded)
Wolfi14 products
- opensearch-dashboards-3< 3.1.0-r4
- opensearch-dashboards-3-alerting-dashboards-plugin< 3.1.0-r4
- opensearch-dashboards-3-anomaly-detection-dashboards-plugin< 3.1.0-r4
- opensearch-dashboards-3-config< 3.1.0-r4
- opensearch-dashboards-3-dashboards-maps< 3.1.0-r4
Browserify1 product
- sha.js≤ 2.4.11
Debian1 product
- node-sha.js< 2.4.12+~3.0.5-1 | < 2.4.11+~2.4.0-2+deb12u1 | < 2.4.11+~2.4.0-2+deb13u1 | < 2.4.11-2+deb11u1
Npm1 product
- sha.js< 2.4.12
Ubuntu1 product
- node-sha.js< 2.4.9-1ubuntu0.1~esm1 | < 2.4.11-2ubuntu0.1~esm1 | < 2.4.11+~2.4.0-1ubuntu0.1 | < 2.4.11+~2.4.0-2+deb13u1build0.24.04.1
6 vendors · 67 products
References
13 links- github.com/browserify/sha.js/security/advisories/GHSA-95m3-7q98-8xr5Vendor AdvisoryREPORTAdvisoryWEBExploit
Show all 13 references
- github.com/browserify/sha.jsPACKAGE