GHSA-mpmc-qchh-r9q8

Source

https://github.com/advisories/GHSA-mpmc-qchh-r9q8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mpmc-qchh-r9q8/GHSA-mpmc-qchh-r9q8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mpmc-qchh-r9q8

Aliases

CVE-2025-65849

Published

2025-12-08T21:30:22Z

Modified

2025-12-12T20:08:03.446058Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Altcha Proof-of-Work obfuscation mode cryptanalytic break

Details

A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction.

Database specific

{
    "github_reviewed_at": "2025-12-09T14:26:12Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-327"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2025-12-08T19:15:50Z"
}

References

Affected packages

npm / altcha

Package

Name: altcha; View open source insights on deps.dev
Purl: pkg:npm/altcha

Affected ranges

Type: SEMVER
Events: Introduced

0.8.0

Last affected

2.2.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mpmc-qchh-r9q8/GHSA-mpmc-qchh-r9q8.json"