Description

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-07T19:18:54.390Z",
  "pubdate": "2026-08-07T19:18:54.390Z",
  "executiveSummary": "Crypto-js versions prior to 4.0.0 contain a critical pseudorandom number generator vulnerability in the CryptoJS.lib.WordArray.random() function. Instead of utilizing a cryptographically secure pseudorandom number generator (CSPRNG), the library implements a custom variation of the Multiply-With-Carry PRNG seeded with Math.random(). This cryptographic weakness significantly reduces the entropy of generated random values, creating nominal 128-bit and 256-bit requests with effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, respectively. These drastically reduced keyspaces are small enough to be efficiently enumerated on commodity hardware. Downstream wallet applications relying on this vulnerable function for generating BIP39 recovery phrases are directly affected. Attackers capable of observing or deducing the reduced output space can successfully enumerate the keys, recover private keys, and gain full control over associated funds. The vulnerability requires no authentication or special privileges to exploit, posing severe financial risks to users of affected downstream applications.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the random number generation mechanism within the CryptoJS.lib.WordArray.random() function. Rather than interfacing with platform-provided cryptographic APIs such as the Web Crypto API or Node.js crypto module, the affected versions introduce a custom variation of the Multiply-With-Carry pseudorandom number generator. This generator is seeded using Math.random(), which is inherently insecure and predictable, lacking the necessary cryptographic entropy required for security-sensitive operations.\nThe vulnerable component is explicitly located in CryptoJS.lib.WordArray.random() across nearly all 3.x releases, specifically introduced in version 3.1.2-4 and persisting until version 4.0.0. The lack of network exposure limitations, authentication requirements, or privilege prerequisites means that any context executing the client-side or server-side JavaScript code can trigger the generation of weak pseudorandom values.\nThe step-by-step attack flow proceeds as follows: First, an affected downstream application—such as a cryptocurrency wallet—calls CryptoJS.lib.WordArray.random() to generate entropy for critical cryptographic material, such as BIP39 recovery phrases or private keys. Second, because the underlying PRNG relies on a custom Multiply-With-Carry algorithm seeded by Math.random(), the output fails to achieve the requested 128 or 256 bits of true entropy. Instead, the effective search space is restricted to approximately 2 to the 39th possibilities for 128 bits and 2 to the 47th possibilities for 256 bits.\nThird, an attacker leverages commodity hardware to perform brute-force enumeration or rainbow table attacks against the reduced output space. By testing the limited set of possible seed states and generated outputs, the attacker can reconstruct the exact recovery phrases or private keys generated by the application.\nFinally, post-exploitation impact is catastrophic: upon successfully recovering the private keys, the attacker gains unauthorized administrative control over the associated funds and assets, enabling illicit transfers and complete compromise of the victim's wallet."
}