The cipher-base package (versions before 1.0.5) lacks proper input type checks in its create-hash polyfill, allowing crafted inputs to cause hash state rewinding, value miscalculations, and denial of service. This can lead to cryptographic inconsistencies such as turning tagged hashes into untagged ones, collisions with different numeric representations, and potential private key extraction scenarios. The vulnerability is critical with a CVSS score of 9.1 and has been fixed in version 1.0.5.