crypto-js has 1 CVE on record. 1 was published in the last 90 days. The median CVSS is 9.0 (critical), with 1 rated critical.

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: 9.0
Publish → KEV: —
Last 90 days: 1 prev 0

Weakness classes

Products

crypto-js 1

Follow crypto-js:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

CVE-2026-71851Critical· 9.0crypto-js is a JavaScript library of crypto standards62

crypto-js vulnerabilities

CVEs affecting crypto-js, newest first. Open any entry for full detail, references, and exploit status.

1 CVERSS

CVE-2026-71851Critical· 9.0PoC

1mo ago

crypto-js is a JavaScript library of crypto standards

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded …

▾ Abyssalcrypto-js · crypto-jsEPSS 0.34%via NVD