{"cve":"CVE-2023-46233","nvd":{"published":"2023-10-25T21:15:10.307","modified":"2026-06-23T18:17:34.057","status":"Modified","description":"crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-327","CWE-328","CWE-916"],"references":["https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a","https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf","https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html","https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a","https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf"],"products":["crypto-js_project:crypto-js"],"source":"nvd","synced_at":"2026-10-19T21:40:11.519948003+00:00"},"epss":{"cve":"CVE-2023-46233","score":0.0064,"percentile":0.50672,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xwcq-pm8m-c4vf","url":"https://osv.dev/vulnerability/GHSA-xwcq-pm8m-c4vf","summary":"crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard","modified":"2026-09-10T03:49:58.831533491Z","packages":[{"ecosystem":"npm","name":"crypto-js","purl":"pkg:npm/crypto-js","ranges":["<4.2.0"],"fixed":["4.2.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}