Skip to content
OpenAdvisories

Package · Debian

cryptojs

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.0
    CVE-2026-71851 Public exploit

    crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

    crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), in…

    brix crypto-js crypto-js cryptojs Debian Ubuntu npm
  • Critical 9.1
    CVE-2023-46233

    crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

    crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SH…

    brix crypto-js crypto-js cryptojs Debian Ubuntu npm
  • Medium 5.3
    CVE-2020-36732

    crypto-js uses insecure random numbers

    The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

    crypto-js cryptojs Debian npm