# CVE-2025-29775: xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

- Exploited (CISA KEV): no
- Published: 2025-03-14
- CVSS: 9.3 CRITICAL (v4.0)
- EPSS: no score
- CWE: CWE-347

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| Vercel | Blocks by default | 2025-03-18 | 4 |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Vercel

- 2025-03-18 · new · default Block
  > We have deployed a proactive security update to the Vercel Firewall , protecting against a recently disclosed vulnerability in the xml-crypto package, dubbed SAMLStorm ( CVE-2025-29774 and CVE-2025-29775 ).
  Source: https://vercel.com/changelog/vercel-firewall-protects-against-the-samlstorm-vulnerability

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-29775 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-29775