browserify vulnerabilities

create-ecdh: computeSecret does not validate that the peer public key is on the curve (invalid-curve attack)

browserify · createECDH

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

browserify · pbkdf2

browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack

browserify · browserify-sign