Description
The crypto-js package 3.2.0 for Node.js generates random numbers by concatenating the string “0.” with an integer, which makes the output more predictable than necessary.
Recommendation
Update the crypto-js package to the latest compatible version. Followings are version details:
- Affected version(s): = 3.2.0
- Patched version(s): 3.2.1
References
Could your website be exposed too?
SmartScanner can check your website for crypto-js uses insecure random numbers and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Elliptic Uses a Broken or Risky Cryptographic Algorithm - CVE-2020-28498
- Expo on iOS is insecure due incorrect security attribute application - CVE-2020-24653
- crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain - CVE-2026-71851
- Insecure random number generation in keypair - CVE-2021-41117
You might also like:
See something that needs correcting? Let us knowUpdated March 16, 2026