CVE-2026-71851 in crypto-js
Summary
by MITRE • 08/07/2026
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The crypto-js library represents a widely-used JavaScript implementation of cryptographic standards that developers rely upon for various security-sensitive operations including key generation, hashing, and encryption tasks. This particular vulnerability stems from a fundamental flaw in the random number generation mechanism implemented within the library's WordArray.random() function. The issue manifests in versions prior to 4.0.0 where the library employs a custom Multiply-With-Carry pseudorandom number generator rather than utilizing cryptographically secure random number generation methods. This deviation from established security practices creates a critical weakness that directly impacts the entropy quality of generated cryptographic material.
The technical flaw lies in the implementation of CryptoJS.lib.WordArray.random() which was introduced in version 3.1.2-4 and persisted through most subsequent 3.x releases. The custom pseudorandom number generator relies on seeding from Math.random(), which is inherently unsuitable for cryptographic purposes as it provides only pseudo-randomness suitable for simulations rather than security applications. This seeding mechanism produces predictable sequences that significantly reduce the effective entropy of the generated values. When developers request 128 or 256 bits of entropy through this function, the actual output space collapses to approximately 2 to the 39th power and 2 to the 47th power possibilities respectively, representing dramatically reduced security margins that make brute force attacks feasible on standard computing hardware.
The operational impact of this vulnerability extends beyond simple cryptographic weakness to represent a severe threat to financial security systems. Downstream applications that utilize crypto-js for generating BIP39 recovery phrases are particularly vulnerable because these phrases serve as the foundation for cryptocurrency wallet access. When entropy sources are compromised through weak random number generation, attackers can enumerate the reduced output space and recover private keys associated with specific wallet addresses. This creates a direct path to unauthorized fund access and represents a critical failure in security architecture that affects users of wallet applications relying on this library. The vulnerability directly maps to CWE-330 use of insufficiently random values as identified in the Common Weakness Enumeration catalog, which specifically addresses weaknesses related to insufficient entropy in cryptographic operations.
The attack surface for this vulnerability encompasses any application that depends on crypto-js version 3.x for generating cryptographic material, particularly those implementing BIP39 standards for cryptocurrency wallet generation. The reduced search space makes this attack vector particularly attractive to threat actors who can leverage commodity hardware to perform exhaustive searches against compromised entropy sources. Security practitioners should note that this issue aligns with ATT&CK technique T1583.001 for developing capabilities using cryptographic libraries and represents a failure in secure coding practices that violates fundamental security principles outlined in NIST Special Publication 800-90A regarding random number generation. The fix implemented in version 4.0.0 addresses this by incorporating proper cryptographically secure random number generation methods, ensuring that entropy sources meet minimum requirements for cryptographic security and preventing the enumeration attacks that were previously possible due to insufficient randomness.