Critical severityOSV Advisory· Published Jul 24, 2025· Updated Apr 15, 2026
CVE-2025-54369
CVE-2025-54369
Description
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
node-samlnpm | <= 3.1.2 | — |
@node-saml/node-samlnpm | < 5.1.0 | 5.1.0 |
Affected products
7- osv-coords6 versionspkg:apk/chainguard/sqlpadpkg:apk/chainguard/sqlpad-compatpkg:apk/wolfi/sqlpadpkg:apk/wolfi/sqlpad-compatpkg:npm/%40node-saml/node-samlpkg:npm/node-saml
< 7.5.6-r1+ 5 more
- (no CPE)range: < 7.5.6-r1
- (no CPE)range: < 7.5.6-r1
- (no CPE)range: < 7.5.6-r1
- (no CPE)range: < 7.5.6-r1
- (no CPE)range: < 5.1.0
- (no CPE)range: <= 3.1.2
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-m837-g268-mmv7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-54369ghsaADVISORY
- github.com/node-saml/node-saml/commit/31ead9411ebc3e2385086fa9149b6c17732bca10nvdWEB
- github.com/node-saml/node-saml/releases/tag/v5.1.0nvdWEB
- github.com/node-saml/node-saml/security/advisories/GHSA-m837-g268-mmv7nvdWEB
News mentions
0No linked articles in our index yet.