react-native-keys insecurely stores encryption cipher and Base64 chunks

Description

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.7.11

References

• GHSA-fj44-h6xw-896g
• CVE-2025-45001
• CWE-312
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• React Router has Path Traversal in File Session Storage - CVE-2025-61686
• The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008
• Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers - CVE-2025-31137
• Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module - CVE-2025-62505

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

react-native-keys