CVE-2026-71851 Details
Description
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0.
A vulnerability exists in the Crypto-JS library, specifically in versions prior to 4.0.0, where the randomness generated by CryptoJS.lib.WordArray.random() is not cryptographically secure. This function used a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a secure source. As a result, nominal requests for 128 or 256 bits of entropy effectively provided only 2^39 and 2^47 possibilities, respectively, which is low enough to be brute-forced on standard hardware. This vulnerability affects downstream wallet applications that relied on this function to generate BIP39 recovery phrases, potentially allowing an attacker to recover private keys and access associated funds.
Users and developers are advised to upgrade Crypto-JS to version 4.0.0 or later. Wallet users should create a new wallet with a recovery phrase generated from a trustworthy source and transfer assets to addresses derived from the new phrase.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5 | [email protected] | Source CodeVendor |
| https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9 | [email protected] | AdvisoryRemedyVendor |
| https://www.coinspect.com/blog/ill-bloom-investigation | [email protected] | BundleTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | [email protected] |
| CWE-334 | Small Space of Random Values | [email protected] |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| crypto-js | < 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 8, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |