# Regulatory updates

### Critical vulnerability (CVE-2025-47934) in OpenPGP.js

May 21, 2025

A critical vulnerability (CVE-2025-47934) in **OpenPGP.js**, a widely used JavaScript library for encryption, allows attackers to **spoof digital signatures**, making altered messages look authentic. This flaw affects versions **5.0.1–5.11.2** and **6.0.0-alpha.0–6.1.0**. It poses a risk to services like **Proton Mail** that rely on the library. The issue has been patched in **versions 5.11.3 and 6.1.1**. Users are urged to update or, as a temporary fix, **verify signatures separately from decryption**.

[An OpenPGP.js flaw just broke public key cryptography](https://www.msn.com/en-us/news/technology/an-openpgp-js-flaw-just-broke-public-key-cryptography/ar-AA1FdkhR?ocid=winp2fptaskbarhover&cvid=3eb34600b2854eaebac9bddd9285466a&ei=10)

#### Categories

- [All Posts](/content/regulatory-updates/index.html)
- [Breach](/content/regulatory-updates?blogcategory=Breach/index.html)
- [CMMC](/content/regulatory-updates?blogcategory=CMMC/index.html)
- [CMS](/content/regulatory-updates?blogcategory=CMS/index.html)
- [Third-party](/content/regulatory-updates?blogcategory=Third-party/index.html)
- [Vulnerability](/content/regulatory-updates?blogcategory=Vulnerability/index.html)

#### Recent Posts

[CMMC DIB Readiness Updates\
\
Oct 6, 2025](/content/regulatory-updates/f/cmmc-dib-readiness-updates/index.html)

[eSIM security flaw\
\
Jul 14, 2025](/content/regulatory-updates/f/esim-security-flaw/index.html)

[Third-party breach affects Scania\
\
Jun 18, 2025](/content/regulatory-updates/f/third-party-breach-affects-scania/index.html)