CVE-2026-71851: crypto-js Information Disclosure Flaw

CVE-2026-71851 Overview

CVE-2026-71851 affects crypto-js, a widely used JavaScript library of cryptographic standards. Versions prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom Multiply-With-Carry pseudorandom number generator seeded from Math.random() instead of a cryptographically secure source. The flawed generator was introduced in version 3.1.2-4 and persisted across nearly every 3.x release. Requests for 128 or 256 bits of entropy produce effective search spaces of roughly 2^39 and 2^47 possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications using this function to derive BIP39 recovery phrases are directly affected. The issue is classified under [CWE-331] (Insufficient Entropy) and resolved in version 4.0.0.

Critical Impact
Attackers can enumerate the reduced entropy space of BIP39 seed phrases generated by crypto-js 3.x, recover private keys, and drain associated cryptocurrency wallets.

Affected Products

crypto-js versions 3.1.2-4 through all 3.x releases
Downstream cryptocurrency wallet applications using CryptoJS.lib.WordArray.random() for BIP39 entropy
Any JavaScript application relying on crypto-jsWordArray.random() for security-sensitive randomness

Discovery Timeline

2026-08-07 - CVE-2026-71851 published to NVD
2026-08-08 - Last updated in NVD database

Technical Details for CVE-2026-71851

Vulnerability Analysis

The vulnerability stems from CryptoJS.lib.WordArray.random() sourcing entropy from Math.random() rather than a cryptographically secure random number generator (CSPRNG). Math.random() is not designed for cryptographic use and its output is predictable given knowledge of internal state or seed. The crypto-js implementation compounded this with a custom Multiply-With-Carry variant that further reduced effective entropy. A nominal 128-bit request yields only about 2^39 unique outputs. A 256-bit request yields approximately 2^47 outputs. Both are brute-forceable on commodity CPUs and GPUs.

Root Cause

The crypto-js core module used a non-cryptographic PRNG for all randomness needs. The library never bridged to crypto.randomBytes() in Node.js or crypto.getRandomValues() in the browser. Any consumer that assumed WordArray.random() produced cryptographically strong output inherited this weakness. Wallet software using this function to seed BIP39 mnemonics silently produced predictable keys.

Attack Vector

An attacker who knows a target used crypto-js 3.x to generate a wallet seed can enumerate the reduced output space offline. For each candidate, the attacker derives the BIP39 mnemonic, computes the associated public addresses, and checks the blockchain for funded wallets. Once a match is found, the attacker controls the private key and can transfer funds. No network interaction with the victim is required beyond public blockchain lookups.

javascript

// Security patch in src/core.js - Add secure random using native crypto module
var CryptoJS = CryptoJS || (function (Math, undefined) {

    /*
     * Cryptographically secure pseudorandom number generator
     *
     * As Math.random() is cryptographically not safe to use
     */
    var secureRandom = function () {
        // Native crypto module on NodeJS environment
        try {
            // Crypto from global object
            var crypto = global.crypto;

            // Create a random float number between 0 and 1
            return Number('0.' + crypto.randomBytes(3).readUIntBE(0, 3));
        } catch (err) {}

        // Native crypto module in Browser environment
        try {
            // Support experimental crypto module in IE 11
            var crypto = window.crypto || window.msCrypto;

            // Create a random float number between 0 and 1
            return Number('0.' + window.crypto.getRandomValues(new Uint32Array(1))[0]);
        } catch (err) {}

        throw new Error('Native crypto module could not be used to get secure random number.');
    };

Source: GitHub Commit b405ff5

Detection Methods for CVE-2026-71851

Indicators of Compromise

Presence of crypto-js versions 3.x in package.json, package-lock.json, or yarn.lock dependency trees
Wallet applications built between the introduction of 3.1.2-4 and the 4.0.0 release that generated seed phrases in-browser or in Node.js
Unexpected outbound transfers from wallets whose seeds were generated by affected client software, as documented in the CoInspect Ill Bloom investigation

Detection Strategies

Perform software composition analysis (SCA) across repositories and CI/CD pipelines to identify vulnerable crypto-js versions
Grep source code and bundled JavaScript for calls to CryptoJS.lib.WordArray.random() in security-sensitive contexts such as key, token, or seed generation
Audit historical build artifacts of any wallet or key-management product to determine whether affected library versions were shipped to end users

Monitoring Recommendations

Track dependency advisories from the GitHub Security Advisory GHSA-rg76-677x-56q9 for updates and downstream impact reports
Monitor on-chain activity for wallets known to have been generated with vulnerable client software and alert on movement
Enable dependency alerting in source control platforms to flag reintroduction of crypto-js<4.0.0

How to Mitigate CVE-2026-71851

Immediate Actions Required

Upgrade crypto-js to version 4.0.0 or later across all applications, libraries, and build pipelines
Treat any key, seed, token, or nonce generated by WordArray.random() in an affected version as compromised and rotate it
For wallet products, notify affected users to migrate funds to newly generated wallets using a patched or audited entropy source

Patch Information

The fix landed in commit b405ff5 and shipped in crypto-js4.0.0. The patch introduces a secureRandom() function that calls crypto.randomBytes() on Node.js and window.crypto.getRandomValues() in browsers, throwing an error if no native CSPRNG is available.

Workarounds

Where an immediate upgrade is not feasible, replace direct calls to CryptoJS.lib.WordArray.random() with wrappers that source bytes from crypto.randomBytes() (Node.js) or crypto.getRandomValues() (browser)
Do not use crypto-js3.x for any purpose that requires cryptographic randomness, including keys, IVs, nonces, salts, and mnemonic seeds
Prefer platform-native cryptographic APIs such as the Web Crypto API or Node.js crypto module for new development

bash

# Upgrade crypto-js to the patched release
npm install crypto-js@^4.0.0

# Verify installed version across the dependency tree
npm ls crypto-js

# Audit for known advisories
npm audit --production