Hash forgery and hangs via unchecked inputs

Improper input validation in Browserify cipher-base 1.0.4 and earlier allows remote attackers to forge hashes or hang applications. CipherBase.prototype.update passes non-string values directly to _update instead of restricting them to Buffer, TypedArray, or DataView inputs, so crafted length and element fields can rewind state, collide with valid inputs, or trigger excessive work. Exploitation requires a consuming application to pass attacker-controlled, nonstandard values into the hashing path; consequences range from integrity bypass to an application hang and, in nonce-dependent cryptography, private-key extraction.