crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

Description

No description available.

Recommendation

Update the crypto-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.2.0
• Patched version(s): 4.2.0

References

• GHSA-xwcq-pm8m-c4vf
• lists.debian.org
• CVE-2023-46233
• CWE-327
• CWE-328
• CWE-916
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file - CVE-2025-46328
• Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to - CVE-2024-39691
• crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard - CVE-2023-46133
• crypto-js uses insecure random numbers - CVE-2020-36732

Tags:

npm

crypto-js