{"id":1525509,"name":"cipher-base","ecosystem":"npm","description":"abstract base class for crypto-streams","homepage":"https://github.com/crypto-browserify/cipher-base#readme","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/crypto-browserify/cipher-base","keywords_array":["cipher","stream"],"namespace":null,"versions_count":8,"first_release_published_at":"2015-09-26T21:01:59.671Z","latest_release_published_at":"2025-09-25T04:52:36.583Z","latest_release_number":"1.0.7","last_synced_at":"2026-10-06T13:16:26.823Z","created_at":"2022-04-09T04:29:39.996Z","updated_at":"2026-10-06T13:16:26.823Z","registry_url":"https://www.npmjs.com/package/cipher-base","install_command":"npm install cipher-base","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"latest":"1.0.7"},"contentPolicy":null},"repo_metadata":{"id":1611626,"uuid":"43222818","full_name":"browserify/cipher-base","owner":"browserify","description":"abstract base class for crypto-streams","archived":false,"fork":false,"pushed_at":"2025-09-25T04:52:33.000Z","size":51,"stargazers_count":21,"open_issues_count":4,"forks_count":43,"subscribers_count":2,"default_branch":"master","last_synced_at":"2026-10-01T00:34:16.573Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/browserify.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":["ljharb"],"patreon":null,"open_collective":null,"ko_fi":null,"tidelift":"npm/cipher-base","community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"custom":null}},"created_at":"2015-09-26T21:00:28.000Z","updated_at":"2026-04-13T05:45:31.000Z","dependencies_parsed_at":"2025-02-15T05:34:56.675Z","dependency_job_id":"69399def-9f93-471f-a044-80836af593c7","html_url":"https://github.com/browserify/cipher-base","commit_stats":null,"previous_names":["crypto-browserify/cipher-base"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/browserify/cipher-base","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/browserify","download_url":"https://codeload.github.com/browserify/cipher-base/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":342085742,"owners_count":37895999,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-10-01T02:00:06.691Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"browserify","name":"Browserify","uuid":"6320506","kind":"organization","description":"browser-side require() the node.js way","email":null,"website":"https://browserify.org","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/6320506?v=4","repositories_count":76,"last_synced_at":"2026-09-28T03:51:40.527Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/browserify","funding_links":[],"total_stars":32085,"followers":165,"following":0,"created_at":"2022-11-02T16:18:55.080Z","updated_at":"2026-09-28T03:51:40.549Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/browserify","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/browserify/repositories"},"tags":[{"name":"v1.0.7","sha":"00567180c846dd3db3848c9223991c58a0d5490c","kind":"tag","published_at":"2025-09-25T04:52:24.000Z","download_url":"https://codeload.github.com/browserify/cipher-base/tar.gz/v1.0.7","html_url":"https://github.com/browserify/cipher-base/releases/tag/v1.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserify/cipher-base@v1.0.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.7/manifests"},{"name":"v1.0.6","sha":"f5249f94611506ef35a8be4d48a3fc5ecf1fac63","kind":"tag","published_at":"2024-11-26T20:07:59.000Z","download_url":"https://codeload.github.com/browserify/cipher-base/tar.gz/v1.0.6","html_url":"https://github.com/browserify/cipher-base/releases/tag/v1.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserify/cipher-base@v1.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.6/manifests"},{"name":"v1.0.5","sha":"f03cebfdad1cba1d56614c58affa303b0fa2a43e","kind":"tag","published_at":"2024-11-17T18:06:23.000Z","download_url":"https://codeload.github.com/browserify/cipher-base/tar.gz/v1.0.5","html_url":"https://github.com/browserify/cipher-base/releases/tag/v1.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserify/cipher-base@v1.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.5/manifests"},{"name":"v1.0.4","sha":"bc18dc847050c34f11f7a0472ff13a76b53fedc6","kind":"tag","published_at":"2017-07-06T12:04:22.000Z","download_url":"https://codeload.github.com/browserify/cipher-base/tar.gz/v1.0.4","html_url":"https://github.com/browserify/cipher-base/releases/tag/v1.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserify/cipher-base@v1.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.4/manifests"},{"name":"v1.0.3","sha":"de2af9758ce75ef5f9a9bdaf0ba5312609a7e59a","kind":"tag","published_at":"2016-09-13T11:44:36.000Z","download_url":"https://codeload.github.com/browserify/cipher-base/tar.gz/v1.0.3","html_url":"https://github.com/browserify/cipher-base/releases/tag/v1.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserify/cipher-base@v1.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.3/manifests"},{"name":"v1.0.2","sha":"c295535e1eef90a587dba110c8799bfd68f75161","kind":"tag","published_at":"2015-10-23T18:30:06.000Z","download_url":"https://codeload.github.com/browserify/cipher-base/tar.gz/v1.0.2","html_url":"https://github.com/browserify/cipher-base/releases/tag/v1.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserify/cipher-base@v1.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.2/manifests"},{"name":"v1.0.1","sha":"5f5eb4a23599806ef5f92aa25930ac0beeb35bd1","kind":"tag","published_at":"2015-09-26T22:00:47.000Z","download_url":"https://codeload.github.com/browserify/cipher-base/tar.gz/v1.0.1","html_url":"https://github.com/browserify/cipher-base/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserify/cipher-base@v1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/tags/v1.0.1/manifests"}]},"repo_metadata_updated_at":"2026-10-02T10:17:22.945Z","dependent_packages_count":387,"downloads":55379422,"downloads_period":"last-month","dependent_repos_count":655514,"rankings":{"downloads":0.03950909065022709,"dependent_repos_count":0.04558741228872357,"dependent_packages_count":0.14201916368865414,"stargazers_count":7.92035644164002,"forks_count":4.290940313876948,"docker_downloads_count":0.03630565086777625,"average":2.0791196788353914},"purl":"pkg:npm/cipher-base","advisories":[{"uuid":"GSA_kwCzR0hTQS1jcHE3LTZncG0tZzlyY84ABLTy","url":"https://github.com/advisories/GHSA-cpq7-6gpm-g9rc","title":"cipher-base is missing type checks, leading to hash rewind and passing on crafted data","description":"### Summary\n\nThis affects e.g. `create-hash` (and `crypto-browserify`), so I'll describe the issue against that package\nAlso affects `create-hmac` and other packages\n\nNode.js `createHash` works only on strings or instances of Buffer, TypedArray, or DataView.\n\nMissing input type checks (in npm `create-hash` polyfill of Node.js `createHash`) can allow types other than a well-formed `Buffer` or `string`, resulting in invalid values, hanging and rewinding the hash state (including turning a tagged hash into an untagged hash), or other generally undefined behaviour.\n\n### Details\n\nSee PoC\n\n### PoC\n```js\nconst createHash = require('create-hash/browser.js')\nconst { randomBytes } = require('crypto')\n\nconst sha256 = (...messages) =\u003e {\n  const hash = createHash('sha256')\n  messages.forEach((m) =\u003e hash.update(m))\n  return hash.digest('hex')\n}\n\nconst validMessage = [randomBytes(32), randomBytes(32), randomBytes(32)] // whatever\n\nconst payload = forgeHash(Buffer.concat(validMessage), 'Hashed input means safe')\nconst receivedMessage = JSON.parse(payload) // e.g. over network, whatever\n\nconsole.log(sha256(...validMessage))\nconsole.log(sha256(...receivedMessage))\nconsole.log(receivedMessage[0])\n```\n\nOutput:\n```\n9ef59a6a745990b09bbf1d99abe43a4308b48ce365935e29eb4c9000984ee9a9\n9ef59a6a745990b09bbf1d99abe43a4308b48ce365935e29eb4c9000984ee9a9\nHashed input means safe\n```\n\nThis works with:\n```js\nconst forgeHash = (valid, wanted) =\u003e JSON.stringify([wanted, { length: -wanted.length }, { ...valid, length: valid.length }])\n```\n\nBut there are other types of input which lead to unchecked results\n\n### Impact\n\n1. Hash state rewind on `{length: -x}`. This is behind the PoC above, also this way an attacker can turn a tagged hash in cryptographic libraries into an untagged hash.\n2. Value miscalculation, e.g. a collision is generated by `{ length: buf.length, ...buf, 0: buf[0] + 256 }`\n    This will result in the same hash as of `buf`, but can be treated by other code differently (e.g. bn.js)\n4. DoS on `{length:'1e99'}`\n5. On a subsequent system, (2) can turn into matching hashes but different numeric representations, leading to issues up to private key extraction from cryptography libraries (as nonce is often generated through a hash, and matching nonces for different values often immediately leads to private key restoration, like [GHSA-vjh7-7g9h-fjfh](https://github.com/indutny/elliptic/security/advisories/GHSA-vjh7-7g9h-fjfh))\n6. Also, other typed arrays results are invalid, e.g. returned hash of `new Uint16Array(5)` is the same as `new Uint8Array(5)`, not `new Uint16Array(10)` as it should have been (and is in Node.js `crypto`) -- same for arrays with values non-zero, their hashes are just truncated to `%256` instead of converted to correct bytelength","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-08-21T14:47:35.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.1,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N","references":["https://github.com/browserify/cipher-base/security/advisories/GHSA-cpq7-6gpm-g9rc","https://nvd.nist.gov/vuln/detail/CVE-2025-9287","https://github.com/browserify/cipher-base/pull/23","https://github.com/browserify/cipher-base/commit/8fd136432ca298a664f5637629cf2b42a6c7f294","https://lists.debian.org/debian-lts-announce/2025/09/msg00005.html","https://github.com/advisories/GHSA-cpq7-6gpm-g9rc"],"source_kind":"github","identifiers":["GHSA-cpq7-6gpm-g9rc","CVE-2025-9287"],"repository_url":"https://github.com/browserify/cipher-base","blast_radius":52.93089594043731,"created_at":"2025-08-21T15:11:00.336Z","updated_at":"2026-10-02T15:07:06.821Z","epss_percentage":0.00529,"epss_percentile":0.42578,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcHE3LTZncG0tZzlyY84ABLTy","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jcHE3LTZncG0tZzlyY84ABLTy","packages":[{"ecosystem":"npm","package_name":"cipher-base","versions":[{"first_patched_version":"1.0.5","vulnerable_version_range":"\u003c= 1.0.4"}],"purl":"pkg:npm/cipher-base"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcHE3LTZncG0tZzlyY84ABLTy/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/cipher-base","docker_dependents_count":10571,"docker_downloads_count":3686072054,"usage_url":"https://repos.ecosyste.ms/usage/npm/cipher-base","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/cipher-base/dependencies","status":null,"funding_links":["https://github.com/sponsors/ljharb","https://tidelift.com/funding/github/npm/cipher-base"],"critical":true,"issue_metadata":{"last_synced_at":"2026-10-01T09:21:34.754Z","issues_count":13,"pull_requests_count":20,"avg_time_to_close_issue":43714107.18181818,"avg_time_to_close_pull_request":31688337.9375,"issues_closed_count":11,"pull_requests_closed_count":16,"pull_request_authors_count":13,"issue_authors_count":13,"avg_comments_per_issue":3.6923076923076925,"avg_comments_per_pull_request":2.3,"merged_pull_requests_count":7,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":0,"past_year_pull_requests_count":0,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":null,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":0,"past_year_pull_request_authors_count":0,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":null,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":0,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserify%2Fcipher-base/issues","maintainers":[{"login":"BridgeAR","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/BridgeAR"},{"login":"dcousens","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dcousens"},{"login":"ahdinosaur","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/ahdinosaur"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/cipher-base/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/cipher-base/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/cipher-base/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/cipher-base/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/cipher-base/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/cipher-base/codemeta","maintainers":[{"uuid":"ljharb","login":"ljharb","name":null,"email":"ljharb@gmail.com","url":null,"packages_count":566,"html_url":"https://www.npmjs.com/~ljharb","role":null,"created_at":"2023-04-08T20:52:27.348Z","updated_at":"2023-04-08T20:52:27.348Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/ljharb/packages"},{"uuid":"cwmma","login":"cwmma","name":null,"email":"calvin.metcalf@gmail.com","url":null,"packages_count":326,"html_url":"https://www.npmjs.com/~cwmma","role":null,"created_at":"2022-11-11T18:40:13.128Z","updated_at":"2022-11-11T18:40:13.128Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/cwmma/packages"},{"uuid":"dcousens","login":"dcousens","name":null,"email":"npm2025+dan@dcousens.com","url":null,"packages_count":357,"html_url":"https://www.npmjs.com/~dcousens","role":null,"created_at":"2023-04-08T23:42:14.584Z","updated_at":"2023-04-08T23:42:14.584Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/dcousens/packages"}]}