Cryptographically Weak PRNG in generate-password

Description

Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords.

Recommendation

Update the generate-password package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.1
• Patched version(s): 1.4.1

References

• GHSA-6qqf-vvcr-7qrv
• www.npmjs.com
• CWE-338
• OWASP 2021-A2

Related Issues

• Insecure password handling vulnerability in Strapi - CVE-2021-46440
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• CouchAuth host header injection vulnerability leaks the password reset token - CVE-2023-39655
• Raneto v0.17.0 employs weak password complexity requirements - CVE-2022-35143

Tags:

npm

generate-password