Threats affecting pkg:npm/pbkdf2

CVE-2026-102414 is a medium severity vulnerability in the browserify pbkdf2 library up to version 3.1.6. It involves uncontrolled resource consumption due to re-hashing of passwords longer than the digest's block size on every iteration in the JavaScript fallback implementation. This causes a computational cost proportional to the product of iterations and password length, potentially blocking the event loop. The issue affects Node.js versions before 0.12, Bun versions 1.0.0 through 1.1.34 and 1.2.6 and later, and Deno 2.9.0 and later when the fallback is used. Node.js 0.12 and later and browser builds are not affected. Applications that enforce reasonable maximum password lengths are not significantly impacted.

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.