CVE-2025-27611

Description

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1.

Is your site exposed to CVE-2025-27611?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-1007 CWE-1007

References

Other References

https://github.com/cryptocoinjs/base-x/pull/86 https://github.com/cryptocoinjs/base-x/security/advisories/GHSA-xq7p-g2vc-g82p

Frequently Asked Questions

What is CVE-2025-27611? +

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1.

How do I check if I'm vulnerable to CVE-2025-27611? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-48760 6.1

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until …

CVE-2026-45064 6.1

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until …

CVE-2025-0996 5.4

Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the …