MediumGHSA-3w3w-pxmm-2w2jCVE-2020-36732
crypto-js uses insecure random numbers
Published 12 Jun 2023 · Updated 16 Mar 2026
Affected package
crypto-jsnpm
- Affected
- >=3.2.0 <3.2.1
- Fixed in
- 3.2.1
Update to the fixed version for your release line, for example:
npm install crypto-js@3.2.1Details
The crypto-js package 3.2.0 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.
Is GHSA-3w3w-pxmm-2w2j in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected crypto-js, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2020-36732
- Linkgithub.com/brix/crypto-js/issues/254
- Linkgithub.com/brix/crypto-js/issues/256
- Linkgithub.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b
- Linkgithub.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5
- Linkgithub.com/brix/crypto-js/commit/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b
- Packagegithub.com/brix/crypto-js
- Linkgithub.com/brix/crypto-js/compare/3.2.0...3.2.1
- Linksecurity.netapp.com/advisory/ntap-20230706-0003
- Linksecurity.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.