An issue was discovered in the bsock component of bcoin-org bcoin that allows remote attackers to obtain sensitive information via weak hashing algorithms in the component \vendor\faye-websocket.js.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-50475
• bcoin-org/bcoin#1174
• https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-50475.md
• https://github.com/bcoin-org/bcoin/blob/master/node_modules/bsock/package.json
• https://github.com/bcoin-org/bsock/blob/master/package.json