Password Processing Issue in pbkdf2 Affects Browserify Products
CVE-2026-102414

6.3MEDIUM

Key Information:

Vendor

Browserify

Status
Pbkdf2
Vendor
CVE Published:
29 September 2026

What is CVE-2026-102414?

The pbkdf2 implementation in Browserify's library processes passwords longer than the block size inefficiently. When such a password is processed, it re-hashes on every iteration, causing a high computational cost of O(iterations Ă— password length). This inefficiency can lead to noticeable delays in application performance, particularly in environments utilizing JavaScript fallbacks in Node.js prior to version 0.12, as well as in Bun and Deno versions that rely on this fallback method. Applications with strict maximum password length policies remain significantly less affected.

Affected Version(s)

pbkdf2 0 <= 3.1.6

References

https://github.com/browserify/pbkdf2/security/advisories/...
vendor-advisory
https://github.com/browserify/pbkdf2/issues/82
issue-tracking
https://github.com/browserify/pbkdf2/commit/493d8d8
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Steve Thomas (Sc00bz)
Jordan Harband (ljharb)
.