Red Hat CVE-2025-6545

PBKDF2 (Password-Based Key Derivation Function 2) is a widely-used cryptographic key derivation function standardized in RFC 2898, commonly employed in password hashing and signature generation workflows. The vulnerability resides in lib/to-buffer.js, which handles input conversion to buffer format—a critical preprocessing step before cryptographic operations. The root cause is CWE-20 (Improper Input Validation), indicating that the library fails to properly validate or sanitize input data before processing it through the PBKDF2 algorithm. This allows an attacker to craft malformed or unexpected input that bypasses validation checks, leading to signature spoofing where invalid signatures are accepted as legitimate. The affected CPE scope includes pbkdf2 package versions 3.0.10 through 3.1.2, commonly deployed in Node.js environments and web authentication systems.