CVE-2026-102414

Executive Summary

CVE-2026-102414 is a computational resource-exhaustion vulnerability in the pbkdf2 JavaScript library (through version 3.1.6), specifically its pure-JavaScript fallback implementation in lib/sync.js. When a password exceeds the digest block size (64 bytes for SHA-1/SHA-256, 128 bytes for SHA-384/SHA-512), the fallback passes the full-length password to HMAC as the key on every iteration, causing HMAC to fully re-hash the key each time and producing O(iterations × password length) cost that can block the JavaScript event loop.

Systems affected are those running the library's fallback path: Node.js before 0.12, Bun 1.0.0–1.1.34 and 1.2.6+, Deno 2.9.0+, and any application that imports lib/sync.js directly. Applications that enforce a reasonable maximum password length are not meaningfully affected. With a CVSS score of 3.7 (Low), the realistic impact is localized availability degradation rather than systemic compromise.

Technical Analysis

The pbkdf2 library provides a JavaScript implementation of PBKDF2 (Password-Based Key Derivation Function 2). On runtimes that expose a compliant native pbkdf2Sync, the library delegates to that native implementation for performance and correctness. On runtimes where the native binding fails the library's feature check, the library silently falls back to the pure-JavaScript implementation located in lib/sync.js.

Root Cause

PBKDF2 derives a key by iterating HMAC over a running state. In a correct implementation, the password is pre-hashed once down to a fixed-length HMAC key, and that short key is reused across all iterations. The lib/sync.js fallback instead passes the caller-supplied password to HMAC as the key on every iteration. When that password is longer than the digest's block size — 64 bytes for SHA-1 and SHA-256, 128 bytes for SHA-384 and SHA-512 — HMAC must first hash the key in full to reduce it to block size. HMAC performs this key-hashing step for every HMAC invocation, i.e., once per PBKDF2 iteration.

The consequence is that the security parameter behaves multiplicatively rather than as intended:

• Intended cost model: roughly O(iterations), independent of password length.
• Actual cost model in the fallback: O(iterations × password length).

An attacker or careless caller who supplies a very long password (thousands or millions of bytes) therefore inflates the per-iteration work proportionally. Because lib/sync.js is synchronous, the work executes on the calling thread — for a Node.js or Bun server that means the event loop, and for a Deno application it means the equivalent single-threaded async executor — so a single call can stall all concurrent request handling for the duration of the computation.

Trigger Conditions

Two conditions must hold simultaneously:

1. Fallback execution. The library must be running lib/sync.js rather than a native binding. Per the description, this occurs on Node.js before 0.12, on Bun 1.0.0 through 1.1.34 and on Bun 1.2.6 and later, and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library's feature check. It also occurs whenever lib/sync.js is imported directly, bypassing the library's internal runtime dispatch.
2. Oversized password input. The password passed to pbkdf2Sync or pbkdf2 must exceed the digest block size (64 or 128 bytes depending on the selected hash). Passwords at or below block size do not exhibit the amplified cost.

Explicitly Unaffected Paths

• Node.js 0.12 and later — the native binding passes the feature check, so lib/sync.js is never used.
• Browser builds — these use lib/sync-browser.js, a separate implementation not implicated by this CVE.
• Length-bounded inputs — applications enforcing a sane maximum password length are not meaningfully affected, because the multiplier on iterations stays small.

Classification

The weakness maps to CWE-400 (Uncontrolled Resource Consumption): attacker-influenced input length deterministically scales CPU work in a synchronous code path. The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L reflects that the flaw is network-reachable in principle (unauthenticated users can submit passwords) but requires a specific and unusual combination of runtime and input characteristics to have effect, and that the impact is confined to low-level availability degradation: no confidentiality or integrity impact, no scope change.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The following attack chain is inferred strictly from the vulnerability class (uncontrolled CPU consumption in a synchronous password-hashing path) and the specifics stated in the NVD description. It does not assume any code structures beyond pbkdf2Sync, pbkdf2, lib/sync.js, and the runtime version conditions explicitly named.

1) Reconnaissance / Target Identification

An attacker enumerates authentication endpoints — login, registration, password-reset, or API key-derivation routes — on services built on Node.js, Bun, or Deno. Version fingerprinting against the affected runtime ranges (Node.js before 0.12, Bun 1.0.0–1.1.34 or 1.2.6+, Deno 2.9.0+) establishes whether the lib/sync.js fallback is likely active. Endpoints must then be tested for whether they forward caller-supplied password values to pbkdf2Sync or pbkdf2 without a length ceiling. This is a low-noise step: it requires only ordinary request submission and observation of response latency.

2) Trigger of the Specific Flaw Class

The attacker submits a password whose length is chosen to be far above the digest block size. With the default SHA-1 or SHA-256 digest, anything above 64 bytes begins to amplify cost; with SHA-384 or SHA-512 the threshold is 128 bytes. Because cost scales with iterations × password length in the fallback, an input of hundreds of kilobytes to several megabytes converts a normally sub-millisecond derivation into a call that occupies the event loop for a sustained period. The selected iteration count — whatever the application configured — multiplies the effect further.

3) Payload / Execution Method (Vulnerability-Class Level)

No crafted payload, serialized object, or injection syntax is required. The "payload" is simply an oversized password string delivered through the normal authentication or key-derivation interface that ultimately reaches the library. Repetition — concurrent or sequential — is the lever: while one synchronous derivation is executing, the event loop cannot service other work, so a small number of simultaneous submissions can saturate the process.

4) Post-Exploitation Impact

Successful triggering yields denial of service against the affected process or worker: request handling stalls, health checks may time out, and upstream load balancers may begin failing connections elsewhere. The attacker gains no data access, no authentication bypass, and no code execution — consistent with the CVSS subscores (C:N/I:N/A:L). Impact ends when the over-long derivation completes or the process is restarted. Practical exploitation is constrained by the high attack complexity component of the vector: the attacker must first confirm both the fallback runtime and the absence of an input-length limit, which real-world deployments frequently do enforce.

Impact Assessment

CVSS subscores (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L):

• AV:N (Network) — the vulnerable function is reachable through any interface that accepts a password from a remote caller; no local access is required.
• AC:H (High) — successful exploitation demands a narrow coincidence: the fallback path must be active, meaning a specific affected runtime or a direct lib/sync.js import, and the application must lack a password length bound. Neither condition is under attacker control and both are commonly absent.
• PR:N (None) — no prior authentication is needed; unauthenticated endpoints such as registration or password-reset are sufficient targets.
• UI:N (None) — no victim interaction is required.
• S:U (Unchanged) — impact remains within the vulnerable process; no privilege or security authority boundary is crossed.
• C:N / I:N — no confidentiality or integrity effect is described.
• A:L (Low) — availability impact is real but bounded: derivations are synchronous and block the event loop, yet the effect is transient and recoverable by process restart.

Blast radius. The exposure set is narrow. Modern Node.js deployments (0.12 and later) never reach the fallback, and browser builds use a different file (lib/sync-browser.js). The affected population is concentrated among long-lived Bun deployments pinned to the stated version bands, current Deno 2.9.0+ services, legacy Node.js pre-0.12 systems, and — most importantly — any codebase that imports lib/sync.js directly, which forces the vulnerable path regardless of runtime. The last category is the highest-risk because it defeats the runtime-based protection entirely.

Business impact. For affected services, the realistic outcome is intermittent or sustained unavailability of authentication and password-derived key operations, with collateral stalls to unrelated requests sharing the same event loop. Because the flaw requires oversized input, an application-level length limit converts the vulnerability into a non-issue, which places most of the effective risk on deployments that have neither bounded input nor a native PBKDF2 path.

Detection Guidance

Detection strategy rests on two observable facts derivable from the description: the vulnerable path is the JavaScript fallback in lib/sync.js, and the abuse pattern is abnormally large password material submitted to password-derivation endpoints. Network and log detections should focus on oversized credential fields and latency spikes in authentication routes; host detections should focus on the presence of the vulnerable import and runtime combination.

Sigma Rule

title: Oversized Password Submitted to Authentication Endpoint (pbkdf2 Event Loop Exhaustion)
id: 9f2c1a44-7b3e-4d18-9c5a-2e6f0b1d8a37
status: experimental
description: >
  Detects authentication, registration, or password-reset requests carrying
  abnormally large password fields. Correlates with CVE-2026-102414, where the
  pbkdf2 lib/sync.js fallback re-hashes over-long passwords on every iteration
  and blocks the event loop.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102414
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - cwe.400
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
  selection_path:
    cs-uri-stem|contains:
      - '/login'
      - '/signin'
      - '/register'
      - '/signup'
      - '/password'
      - '/reset'
      - '/auth'
      - '/token'
  selection_size:
    sc-bytes|gte: 4096
  selection_field:
    cs-uri-query|contains:
      - 'password='
      - 'passwd='
      - 'pwd='
  condition: selection_method and selection_path and (selection_size or selection_field)
falsepositives:
  - Legitimate uploads or form posts to paths containing 'auth' or 'password'
  - API clients transmitting large encoded payloads to token endpoints
level: low

YARA Rule

rule CVE_2026_102414_pbkdf2_sync_fallback
{
    meta:
        description = "Detects the pbkdf2 JavaScript fallback (lib/sync.js) and related artifacts associated with CVE-2026-102414"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102414"
        cwe = "CWE-400"

    strings:
        $f1 = "pbkdf2Sync" ascii
        $f2 = "lib/sync.js" ascii
        $f3 = "sync-browser.js" ascii
        $h1 = "HMAC" ascii nocase
        $h2 = "createHmac" ascii
        $p1 = "pbkdf2" ascii
        $b1 = "blockSize" ascii

    condition:
        filesize < 2MB and
        (
            (uint16(0) == 0x2321 or uint32(0) == 0x6a732f2f) or true
        ) and
        (
            (2 of ($f1, $f2, $p1)) or
            ($f2 and $b1 and 1 of ($h1, $h2)) or
            ($f1 and $b1 and 1 of ($h1, $h2))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102414 pbkdf2 Oversized Password Submission - Event Loop Exhaustion Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"password"; nocase; http.request_body; content:"password="; nocase; dsize:>4096; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-102414; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102414; sid:2026102414; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where http.request.method == "POST" and
     wildcard(http.request.uri.path, "*login*") or
     wildcard(http.request.uri.path, "*auth*") or
     wildcard(http.request.uri.path, "*password*") and
     network.bytes > 4096]
  [network where http.request.method == "POST" and
     wildcard(http.request.uri.path, "*login*") or
     wildcard(http.request.uri.path, "*auth*") or
     wildcard(http.request.uri.path, "*password*") and
     network.bytes > 4096]

Complementary EQL for application logs where derivation latency is recorded:

sequence by user.name with maxspan=60s
  [any where event.action == "password_derivation_started"]
  [any where event.action in ("request_timeout", "event_loop_delay_high")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval pwfield_len = len(coalesce(form_password, password, request_body, ""))
| where pwfield_len > 256 OR bytes > 4096
| where match(uri, "(?i)(login|signin|register|signup|password|reset|auth|token)")
| stats count AS large_auth_requests,
        avg(bytes) AS avg_bytes,
        max(pwfield_len) AS max_password_len,
        dc(uri) AS distinct_paths
        BY clientip, host
| where large_auth_requests >= 5
| sort - large_auth_requests
| table host clientip large_auth_requests avg_bytes max_password_len distinct_paths

Correlation query for latency correlation during the same window:

index=app sourcetype=nodejs:app OR sourcetype=bun:app OR sourcetype=deno:app
| bin _time span=1m
| stats avg(response_time_ms) AS avg_latency, max(event_loop_delay_ms) AS max_loop_delay BY _time, host
| where max_loop_delay > 1000 OR avg_latency > 2000
| sort - max_loop_delay

Wazuh OSSEC Rule

<group name="web,cve-2026-102414,dos,">
  <rule id="1024140" level="5">
    <decoded_as>json</decoded_as>
    <field name="http.request.method">POST</field>
    <regex field="http.request.uri.path">(?i)(login|signin|register|signup|password|reset|auth|token)</regex>
    <field name="http.request.body.bytes" compare="&gt;">4096</field>
    <description>CVE-2026-102414: Oversized credential payload sent to authentication endpoint (potential pbkdf2 event-loop exhaustion)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="1024141" level="10">
    <if_sid>1024140</if_sid>
    <field name="http.request.body.bytes" compare="&gt;">262144</field>
    <description>CVE-2026-102414: Extremely large credential payload (greater than 256 KB) - high-confidence pbkdf2 fallback abuse pattern</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="1024142" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.action">password_derivation_completed</field>
    <field name="event.duration_ms" compare="&gt;">1000</field>
    <description>CVE-2026-102414: Password derivation exceeded one second - possible oversized input on pbkdf2 lib/sync.js fallback</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix is listed, and no fixed version has been identified. The guidance below is therefore mitigation-only and does not presume the availability of an upstream update.

1) Immediate Mitigations

• Enforce a maximum password length at the application layer. This is the single most effective control. The description states plainly that applications enforcing a reasonable maximum password length are not meaningfully affected, because the amplified cost term scales with input length. Reject or truncate credential inputs beyond a small bound well under 64 bytes where policy permits, or accept up to a modest ceiling but never allow unbounded input to reach the derivation function.
• Avoid direct imports of lib/sync.js. Importing the fallback file directly forces the vulnerable code path regardless of runtime. Route all calls through the library's normal public interface so the native binding is used where available.
• Run an affected workload on a runtime that is not in scope. Node.js 0.12 and later are explicitly not affected because the native pbkdf2Sync passes the library's feature check. Migrating Bun and Deno workloads to a supported native path, or to Node.js 0.12+, removes the fallback entirely.
• Isolate derivation work off the main event loop. Where the fallback cannot be avoided, execute it in a worker thread or separate process so that CPU saturation does not stall request handling for the rest of the service. This reduces the availability impact but does not eliminate the underlying excessive computation.
• Rate-limit and cap request body size on all authentication, registration, and password-reset routes at the reverse proxy or load balancer, limiting how quickly an attacker can submit repeated oversized derivations.

2) Patch / Upgrade Steps

No fixed version of pbkdf2 has been published as of this report, and no vendor advisory exists. Until a patched release is available:

1. Track the pbkdf2 project repository and package registry (pbkdf2 on npm) for releases beyond 3.1.6 and review their changelogs for a correction to the lib/sync.js iteration logic.
2. Do not assume that upgrading the runtime alone is sufficient if your code imports lib/sync.js directly — that import must be removed independently.
3. Where a patched version does appear, upgrade and verify that the fallback path now pre-hashes the password once rather than passing the full-length input to HMAC per iteration.

3) Long-Term Hardening

• Input length validation as a standing control. Treat unbounded string inputs to any computationally expensive derivation, hash, or encryption routine as a security-relevant defect. PBKDF2, bcrypt, scrypt, and Argon2 all have well-defined input expectations that should be enforced.
• Prefer native, hardened cryptographic primitives. Pure-JavaScript fallbacks exist for portability, not for performance or side-channel safety. Where a vetted native binding is available, ensure it is actually exercised and monitor the runtime feature check so silent fallback does not occur.
• Add performance regression tests to build pipelines. A unit test that asserts derivation time stays roughly constant as password length grows would have surfaced this behavior before deployment.
• Monitor event-loop delay and derivation latency in production. Elevated loop delay correlated with authentication traffic is a reliable indicator that a synchronous derivation is being driven with oversized input.
• Maintain a software bill of materials covering the pbkdf2 dependency and its transitive dependents so that affected applications — especially those on the stated Bun and Deno version ranges — can be enumerated rapidly if a patch is released.

References

1. NVD — CVE-2026-102414: https://nvd.nist.gov/vuln/detail/CVE-2026-102414
2. CWE-400: Uncontrolled Resource Consumption — https://cwe.mitre.org/data/definitions/400.html
3. MITRE ATT&CK T1499: Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/
4. pbkdf2 JavaScript library (npm package): https://www.npmjs.com/package/pbkdf2
5. FIRST EPSS: No score published for CVE-2026-102414 at the time of writing. CISA KEV: not listed.

Exploit-in-the-wild status: No public proof-of-concept, exploit code, or Nuclei template is available. There is no CISA KEV listing and no reported threat actor campaign associated with this CVE. Exploitation is constrained by the high attack complexity component of the CVSS vector, which requires both an affected fallback runtime and the absence of an application-level password length limit.