Browserify is a JavaScript bundler and ecosystem of cryptographic and utility modules widely used in Node.js and browser-based applications, with a vulnerability footprint concentrated in signing, cipher, and hashing components such as browserify-sign, cipher-base, and sha.js. The recurring weakness classes center on improper input validation and cryptographic signature verification, reflecting the parsing and validation demands of these core cryptographic primitives. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Browserify over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-9288CRITICAL Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. | Aug 20, 2025 | 9.1 | 33 | NO | NO |
CVE-2025-9287CRITICAL Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4. | Aug 20, 2025 | 9.1 | 31 | NO | NO |
CVE-2023-46234HIGH browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound c | Oct 26, 2023 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Browserify.
Media articles that mention a CVE ID that affects a product developed by Browserify — matched by CVE ID, not by vendor name.