npmPackage

crypto-js

3 known vulnerabilities (2 critical, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 4.2.0 (Oct 24, 2023): no advisory affects it
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 2 critical, 1 medium

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-71851Critical 9.0
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Affected: fixed in 4.0.0.
Fixed in 4.0.0 (released Feb 12, 2020, 2368 days before disclosure).
The latest release, 4.2.0, is not affected.
3.2% of crypto-js downloads last week were affected versions (948.3K).
CVE-2023-46233Critical 9.1
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
Affected: fixed in 4.2.0.
Fixed in 4.2.0 (released Oct 24, 2023, 1 day before disclosure).
The latest release, 4.2.0, is not affected.
6.5% of crypto-js downloads last week were affected versions (2M).
CVE-2020-36732Medium 5.3
The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the…
Affected: from 3.2.0, fixed in 3.2.1.
Fixed in 3.2.1 (released Feb 11, 2020, 1217 days before disclosure).
The latest release, 4.2.0, is not affected.
<0.1% of crypto-js downloads last week were affected versions (417).