CVE-2026-71851

Name of the Vulnerable Software and Affected Versions crypto-js versions prior to 4.0.0

Description The CryptoJS.lib.WordArray.random() function uses a custom variation of the Multiply-With-Carry pseudorandom number generator seeded from Math.random() instead of a cryptographically secure source. This results in a significantly reduced search space for entropy; requests for 128 or 256 bits of entropy produce only approximately 2^39 and 2^47 possibilities, respectively, which can be enumerated on commodity hardware. Downstream wallet applications using this function for BIP39 recovery phrases are affected, allowing attackers to recover private keys and control funds. Real-world incidents involving coordinated drain waves have resulted in stolen assets estimated at a lower bound of $5M. An application is only exploitable if it uses the vulnerable function to generate security-sensitive values.

Recommendations Update crypto-js to version 4.0.0 or later. As a temporary mitigation, avoid using the CryptoJS.lib.WordArray.random() function to generate security-sensitive values and instead use the native Web Crypto API or Node.js crypto module. Rotate all long-term secrets generated through the affected path as they must be treated as compromised.