Skip to main content
cve.nowby Sazabi
← npm
npmPackage

xml-crypto

3 known vulnerabilities (3 critical), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 3 critical
Registry
npm

Advisories 3

  • CVE-2025-29775Critical 9.3

    xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

    Affected: from 4.0.0, fixed in 6.0.1; from 3.0.0, fixed in 3.2.1; fixed in 2.1.6.

  • CVE-2025-29774Critical 9.3

    xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

    Affected: from 4.0.0, fixed in 6.0.1; from 3.0.0, fixed in 3.2.1; fixed in 2.1.6.

  • CVE-2024-32962Critical 10.0

    XML signature verification bypass due improper verification of signature / signature spoofing

    Affected: from 4.0.0, fixed in 6.0.0.