Skip to content

Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) #1534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Naq302 wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) #1534

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
583cfc4
fix: update sha.js to 2.4.12 to fix critical hash vulnerability (CVE…
Naq302 Sep 5, 2025
932bc4e
Also changed to cipher-base@^1.0.5
Naq302 Sep 5, 2025
cd3fa94
Pinned versions
Naq302 Sep 5, 2025
9eef0d4
Pinned versions
Naq302 Sep 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,8 @@
"word-wrap": "1.2.4",
"undici": "5.29.0",
"form-data": "4.0.4",
"elliptic": "^6.6.1"
"elliptic": "^6.6.1",
"sha.js": "^2.4.12"
Copy link
Contributor

@coderabbitai coderabbitai bot Sep 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Root-level resolution doesn’t protect downstream consumers of published packages.

This only enforces the fix for this monorepo’s installs. If any published XChainJS packages ship code that (directly or transitively) pulls sha.js, consumers can still resolve a vulnerable version. Propagate the fix by bumping direct deps or adding a direct "sha.js": "^2.4.12" dependency in each affected workspace package and cut patch releases via Changesets.
Follow-ups:

  • Add/upgrade direct deps (or bump intermediates like create-hash/crypto-browserify if they carry sha.js).
  • Run a patch release across affected packages so users get the fix without relying on their own resolutions.
    If you want, I can script the package-by-package updates.

},
"devDependencies": {
"@actions/core": "1.10.0",
Expand Down
28 changes: 20 additions & 8 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11472,7 +11472,7 @@ __metadata:
languageName: node
linkType: hard

"safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:~5.2.0":
"safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
version: 5.2.1
resolution: "safe-buffer@npm:5.2.1"
checksum: 10c0/6501914237c0a86e9675d4e51d89ca3c21ffd6a31642efeba25ad65720bce6921c9e7e974e5be91a786b25aa058b5303285d3c15dbabf983a919f5f630d349f3
Expand Down Expand Up @@ -11610,15 +11610,16 @@ __metadata:
languageName: node
linkType: hard

"sha.js@npm:2, sha.js@npm:^2.4.0, sha.js@npm:^2.4.8":
version: 2.4.11
resolution: "sha.js@npm:2.4.11"
"sha.js@npm:^2.4.12":
version: 2.4.12
resolution: "sha.js@npm:2.4.12"
dependencies:
inherits: "npm:^2.0.1"
safe-buffer: "npm:^5.0.1"
inherits: "npm:^2.0.4"
safe-buffer: "npm:^5.2.1"
to-buffer: "npm:^1.2.0"
bin:
sha.js: ./bin.js
checksum: 10c0/b7a371bca8821c9cc98a0aeff67444a03d48d745cb103f17228b96793f455f0eb0a691941b89ea1e60f6359207e36081d9be193252b0f128e0daf9cfea2815a5
sha.js: bin.js
checksum: 10c0/9d36bdd76202c8116abbe152a00055ccd8a0099cb28fc17c01fa7bb2c8cffb9ca60e2ab0fe5f274ed6c45dc2633d8c39cf7ab050306c231904512ba9da4d8ab1
languageName: node
linkType: hard

Expand Down Expand Up @@ -12293,6 +12294,17 @@ __metadata:
languageName: node
linkType: hard

"to-buffer@npm:^1.2.0":
version: 1.2.1
resolution: "to-buffer@npm:1.2.1"
dependencies:
isarray: "npm:^2.0.5"
safe-buffer: "npm:^5.2.1"
typed-array-buffer: "npm:^1.0.3"
checksum: 10c0/bbf07a2a7d6ff9e3ffe503c689176c7149cf3ec25887ce7c4aa5c4841a8845cc71121cd7b4a4769957f823b3f31dbf6b1be6e0a5955798ad864bf2245ee8b5e4
languageName: node
linkType: hard

"to-regex-range@npm:^5.0.1":
version: 5.0.1
resolution: "to-regex-range@npm:5.0.1"
Expand Down