---
id: CVE-2026-71851
title: crypto-js is a JavaScript library of crypto standards
summary: >-
  crypto-js is a JavaScript library of crypto standards. Versions of crypto-js
  prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a
  custom variation of the Multiply-With-Carry pseudorandom number generator,
  seeded …
severity: critical
cvss: 9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-331
  - CWE-334
  - CWE-338
vendor: crypto-js
product: crypto-js
affected:
  - crypto-js < 4.0.0
patched:
  - crypto-js 4.0.0
published: '2026-08-07'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71851'
references:
  - url: >-
      https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5
    label: security-advisories@github.com
  - url: 'https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9'
    label: security-advisories@github.com
  - url: 'https://www.coinspect.com/blog/ill-bloom-investigation'
    label: security-advisories@github.com
  - url: 'https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-rg76-677x-56q9'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71851.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-71851'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512613'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-71851'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71851'
tags:
  - nvd
  - exploit-available
  - ghsa
  - npm
  - csaf
  - vex
  - red-hat
epss: 0.0055
epssPercentile: 0.43546
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/brendonlee20042004-sys/weakrng-sweep'
  checkedAt: '2026-09-25T08:21:10.715Z'
exploitAvailable: true
aliases:
  - GHSA-rg76-677x-56q9
ecosystem: npm
ingestedAt: '2026-08-07T19:16:20.159Z'
---

## Overview

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71851)

Affected packages:

- `crypto-js < 4.0.0`

Patched in:

- `crypto-js 4.0.0`

Source: https://github.com/advisories/GHSA-rg76-677x-56q9

## Vendor advisories

- **Red Hat VEX** · Important · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71851.json)