Skip to content
Fencer Intel
critical 9.0

CVE-2026-71851 json

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

published 3mo ago modified 18d ago also EUVD-2026-54599 , GHSA-rg76-677x-56q9

cvss
9.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0.

Patch / fix

  • npm crypto-js 4.0.0
  • crypto-js_project crypto-js 4.0.0

Is CVE-2026-71851 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-71851 updated cvss 9.0

crypto-js: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

  • Red Hat build of Apache Camel for Spring Boot 4 rhaf-camel-spring-boot-maven-repository.zip 4.18.1.CS4, rhaf-camel-for-springboot-maven-repository.zip 3.5.16.CS2 Red Hat Enterprise Linux 8 dotnet, dotnet-host, dotnet-sdk-8.0, dotnet-sdk-9.0, dotnet-hostfxr-8.0, dotnet-hostfxr-9.0, +24 more Red Hat Enterprise Linux 9 dotnet-host, dotnet-sdk-8.0, dotnet-sdk-9.0, dotnet-hostfxr-8.0, dotnet-hostfxr-9.0, dotnet-runtime-8.0, +23 more Red Hat Enterprise Linux 10 dotnet8.0 8.0.130-2.el10, dotnet9.0 9.0.120-2.el10 Red Hat Hardened Images dotnet8.0 8.0.130-2.el10, dotnet9.0 9.0.120-2.el10, dotnet10.0 10.0.112-1.hum1 Red Hat Satellite 6 satellite/iop-advisor-frontend-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
3mo ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm crypto-js
<4.0.0
4.0.0

Affected products

  • brix crypto-js

Classification

Weakness
  • CWE-331 Insufficient Entropy
  • CWE-334 Small Space of Random Values
  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of brix/crypto-js published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.