crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Description

CryptoJS.lib.WordArray.random() in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware.

Recommendation

Update the crypto-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.0.0
• Patched version(s): 4.0.0

References

• GHSA-rg76-677x-56q9
• www.coinspect.com
• CVE-2026-71851
• CWE-331
• CWE-334
• CWE-338
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain - CVE-2026-22686
• open-webui Vulnerable to Stored XSS via Model Description - CVE-2026-44721
• Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680
• React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

crypto-js