GHSA-mpmc-qchh-r9q8

Altcha Proof-of-Work obfuscation mode cryptanalytic break

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-65849

Packages

Ecosystem	Package	Affected	Fixed in
npm	altcha	>= 0.8.0, <= 2.2.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-65849 advisory
https://altcha.org/docs/v2/obfuscation web
https://github.com/altcha-org/altcha package
https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194 web
https://github.com/eternal-flame-AD/altcha-deobfs web