pbkdf2 (npm) EUVD-2026-88626

Exploitation requires ALL of: (1) the application runs on a runtime that uses the JS fallback - Node.js before 0.12, Bun 1.0.0-1.1.34 or 1.2.6 and later, Deno 2.9.0 and later, or code that imports lib/sync.js directly (native pbkdf2Sync on Node.js 0.12+ and browser builds via lib/sync-browser.js are NOT affected); (2) the application passes attacker-controlled data as the PBKDF2 password/key; and (3) the application does NOT enforce a reasonable maximum password length. The limiting factors are the non-default/niche runtimes and the fact that any password-length cap neutralizes the flaw; no authentication or user interaction is needed once these conditions hold.

This is a genuine but modest-severity denial-of-service issue, correctly rated around CVSS 6.3 (4.0) / ~5.3 (3.1). The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L) shows a network-reachable, unauthenticated, low-complexity flaw with only LOW availability impact and no confidentiality or integrity impact - consistent with an event-loop stall rather than a crash or code execution. The AT:P (attack requirement present) metric is the key limiter: the vulnerable code path only runs on specific runtimes (Node.js before 0.12, Bun 1.0.0-1.1.34 and 1.2.6+, Deno 2.9.0+, or when lib/sync.js is imported directly) AND only matters if the application accepts overly long, user-controlled passwords without a maximum-length check. Modern Node.js and browser builds are entirely unaffected. There is NO EPSS score, NO CISA KEV listing, and NO standalone public exploit - only a regression/timing test shipped with the fix commit, which is not weaponized exploit code. The impact is a recoverable performance degradation (blocked event loop), not a persistent outage. Net: this is a real, patchable hygiene fix for a hot dependency, but it is a low-real-risk issue for most deployments because default modern runtimes are unaffected and any application enforcing a sane password length is not meaningfully exposed. Priority should be driven by whether you actually run Bun/Deno/legacy-Node and lack input-length validation.

An application running on Bun or Deno uses pbkdf2Sync to hash user-supplied passwords and imposes no maximum length. An attacker submits a login or registration request containing a multi-megabyte 'password'; the JS fallback re-hashes that oversized key on every one of the thousands of PBKDF2 iterations, pinning the single-threaded event loop and stalling all concurrent requests. No public exploit code exists, but the fix commit includes a timing test that demonstrates the O(iterations × password length) cost with a 1 MiB password.