CVE-2025-54884 Details
Description
Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the generateSecureId and getSecureRandomInt functions in security-kit versions prior to 3.5.0 (packaged in Vision UI 1.4.0 and below) are vulnerable to Denial of Service (DoS) attacks. The generateSecureId(length) function directly used the length parameter to size a Uint8Array buffer, allowing attackers to exhaust server memory through repeated requests for large IDs since the previous 1024 limit was insufficient. The getSecureRandomInt(min, max) function calculated buffer size based on the range between min and max, where large ranges caused excessive memory allocation and CPU-intensive rejection-sampling loops that could hang the thread. This issue is fixed in version 1.5.0.
A denial-of-service vulnerability has been identified in Vision UI versions through 1.4.0, specifically within the security-kit module versions prior to 3.5.0. The issue arises in the generateSecureId and getSecureRandomInt functions, which are susceptible to uncontrolled resource allocation. The generateSecureId function allowed attackers to exhaust server memory by requesting large IDs, as it directly used the length parameter to size a buffer without adequate limits. Similarly, the getSecureRandomInt function could cause excessive memory use and CPU load by allocating large buffers based on wide numerical ranges, leading to performance degradation and application unresponsiveness.
Users are advised to upgrade to Vision UI version 1.5.0, which includes the necessary fixes. Instructions for upgrading can be found in the release notes on the Vision UI GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2025CISA-ADP
Assessed Aug 6, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DavidOsipov/Vision-ui/commit/74802cd688b661a35e638fc96938d65ca7c05ff5 | [email protected] | Source CodeVendor |
| https://github.com/DavidOsipov/Vision-ui/releases/tag/1.5.0 | [email protected] | Release NotesVendor |
| https://github.com/DavidOsipov/Vision-ui/security/advisories/GHSA-gg28-wc2c-jjj3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DavidOsipov Vision UI | All versions |
CPE
Remediation
| |
| DavidOsipov security-kit | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2025 | New CVE Received | [email protected] |