Miggo Vulnerability Database - CVE-2026-71851: crypto-js Insufficient Entropy

Abstract: CVE-2026-71851 is a critical insufficient entropy vulnerability in CryptoJS.lib.WordArray.random() the library crypto-js. In the affected versions, the generation of cryptographically important values was based on a user-defined Multiply-With-Carry (MWC) generator initialized by Math.random(), rather than on a cryptographically strong randomness source. Therefore, the nominal 128 and 256 bits of random data have an effective complexity of order 1 2^39 and 2 2^47 , respectively; this shifts the secret recovery problem from the realm of cryptanalytically infeasible brute-force search to the realm of offline state enumeration.

Keywords: CVE-2026-71851, crypto-js, entropy, CSPRNG, MWC, Math.random(), BIP39, mnemonics, cryptanalysis, brute-force attack, supply chain.

1. Object and boundaries of analysis

The Miggo page referenced in the source material primarily contains navigation and product information (“Basic Information,” “Technical Details,” exposure check suggestions, and WAF rules), but does not publish a technical description, CVSS vector, version list, or proof of exploitation. Therefore, a scientifically sound analysis requires explicitly separating the contents of the Miggo page from the verified CVE entry and advisory sources.

Miggo card category	What is actually available	Scientific interpretation
Basic Information	Identifier `CVE-2026-71851` and name crypto-js Insufficient Entropy .	Identification of the vulnerability, but not its technical specification.
Technical Details	The extracted contents contain no details.	Attack parameters must be verified against CVE/advisory, not supplemented with guesswork.
Validate Exposure	A call to match CVEs with their environment.	The correct unit of analysis is not just the installed packet, but the data path from the weak RNG to the secret.
WAF rules	Marketing proposal rules.	The WAF does not fix the generation defect; updates, secret rotation, and auditing of historical artifacts are required.

2. The actual essence of CVE

CryptoJS.lib.WordArray.random() A function in versions prior to 4.0.0 is vulnerable crypto-js if its result was used for security-sensitive data: keys, seeds, IVs, tokens, or other secrets. The mere presence of a transitive dependency crypto-js < 4.0.0 does not prove exploitability: it is necessary to establish that the function was called and the purpose of the generated value.

The problem is classified as insufficient entropy: the MWC construct was seeded with a value Math.random()that the JavaScript specification does not mandate to be cryptographically secure. Due to the small hidden state and the determinism of subsequent words, the actual uncertainty of the output string is much smaller than its length.

3. Cryptanalytic model

Let an application request n bits and receive a string X. In a secure model, X is uniformly distributed over a space of size 2^n; the expected number of brute-force attempts is approximately half the space. In a vulnerable model, the set of reachable outputs is the image of a small set of internal states S, so the length of X is not important, but log2(|S|).

H∞(X) = −log2(max_x Pr[X = x])

W_eff = 2^(H_eff), E[попыток] ≈ W_eff / 2

n = 128: H_eff ≈ 39, W_eff ≈ 2^39
n = 256: H_eff ≈ 47, W_eff ≈ 2^47

This isn’t an attack on AES, SHA-256, secp256k1, or PBKDF2 as primitives. It’s an attack on the derivation of the key material: a strong one-way function can’t “add” the missing entropy. If the input is chosen from a small set, the attacker iterates through that set, runs the candidates through the entire public derivation pipeline, and verifies the result.

The gap between the stated and effective strength is expressed as follows: for a 128-bit request, a reduction from 128 to 39 bits represents a multiplier of approximately 2^89; for a 256-bit request, a reduction from 256 to 47 bits, or approximately 2^209. In practical terms, this fundamentally changes the economics of an offline attack.

4. Historical context

Happening	Cryptanalytics lesson	Link to CVE-2026-71851
Debian OpenSSL (2006–2008)	Due to a buggy patch, the key space became extremely small; key security is determined by the entropy of generation, not the size of the RSA modulus.	The same root cause: a formally correct cryptographic algorithm is powerless with predictable key material.
Netscape SSL PRNG (1990s)	Predictable sources of state and time allowed the generator to be modeled and session parameters to be restored.	`Math.random()` and a deterministic PRNG cannot be considered a source of a CSPRNG-level.
Android Bitcoin RNG (2013)	Poor randomness in ECDSA led to nonce repetition or predictability and compromise of private keys.	Bitcoin scenarios are particularly sensitive to RNGs: a bug before cryptography is applied can irreversibly reveal access to funds.
Dual_EC_DRBG (2007–2013)	Hidden structure or insufficient trust in the generator undermines all protocols that use its output.	The RNG must have a clear threat model, sufficient internal state, and an independent source of entropy.

These episodes share a common principle: a cryptosystem is only as strong as the weakest stage of a secret’s lifecycle. CVE-2026-71851 demonstrates a modern variant of the same flaw in the JavaScript ecosystem and npm dependency chains.

5. Risk to BIP39

A particularly dangerous approach is WordArray.random() to use the result as entropy for a BIP39 mnemonic. BIP39 adds a checksum and encodes the entropy in words; this process improves backup convenience but does not increase the unpredictability of the original ENT.

CS = first(ENT / 32) bits of SHA256(ENT)
MNEMONIC = encode_11bit(ENT || CS)
seed = PBKDF2-HMAC-SHA512(MNEMONIC, "mnemonic" || passphrase, 2048, 512)

An attacker can enumerate the reachable states of a weak generator, reproduce ENT, obtain mnemonics, and derive wallet addresses in the standard manner. The presence of a public address, transaction history, or a non-zero balance yields a verifiable oracle: a candidate either produces an observed address or it does not. An important consequence: subsequent hashing or PBKDF2 does not restore lost bits of entropy; it only transforms a small set of candidates into another small set.

6. Vulnerable and secure code

Anti-pattern: Legacy CryptoJS

// НЕ использовать для ключей, BIP39, токенов, IV и nonce
const entropy = CryptoJS.lib.WordArray.random(32);

This call is only dangerous if the result has a cryptographically significant purpose, but such a purpose is often implied by the method name random. A historical practical problem with libraries is that APIs with neutral names easily end up in wallet generation code and authorization artifacts.

Secure browser option

function secureBytes(length) {
  const out = new Uint8Array(length);
  crypto.getRandomValues(out);
  return out;
}
const entropy256 = secureBytes(32);

The Web Crypto API delegates randomness to the platform implementation; for cryptographic secrets, this is a valid architectural boundary. The historical lesson of Android’s Bitcoin RNG demonstrates that the choice of API must be accompanied by control over the actual runtime environment and timely platform updates.

A secure Node.js option

import { randomBytes } from 'node:crypto';
const entropy256 = randomBytes(32);

randomBytes(32) This is intended for cryptographically strong bytes from the system CSPRNG. It cannot be replaced with [ Math.random()unspecified value], home-made LCG/MWC constructions, or random float-to-byte conversions.

7. Operational chain

The application contains an affected version crypto-js or a bundled copy of its source code.
The execution path calls CryptoJS.lib.WordArray.random() for the creation of a secret.
A weak RNG produces output from a limited set of possible states.
An offline attacker enumerates states, replays the derivation, and verifies candidates against an available oracle: address, MAC, known ciphertext/plaintext, token, or public key.
If there is a match, the secret is restored and, depending on the purpose, it becomes possible to compromise the funds, session, or encrypted data.

This model does not require network access to the vulnerable server during brute-force attacks. Therefore, a WAF is only useful against isolated network attacks, but is not a means of correcting existing weak secrets.

8. Audit and confirmation

You need to look not only for the package version but also for semantic calls. Check lock files, bundled files, old frontend artifacts, plugins, forks, and CDN copies; then determine whether the output is passed to the generation of mnemonics, keys, nonces, IVs, reset tokens, cookie secrets, or other authentication data.

# npm-проекты: инвентаризация зависимостей
npm ls crypto-js
npm audit --omit=dev

# Поиск вероятных вызовов в исходниках и сборках
grep -RIn --exclude-dir=node_modules \
  'CryptoJS\.lib\.WordArray\.random' .

Important: Do not publish seed phrases, private keys, real addresses linked to an owner, or production artifact dumps in tickets or reports. Investigations into historical wallet compromises should be conducted in an isolated incident response procedure with legally approved access.

9. Elimination and reaction

Action	Why is this necessary?	A critical nuance
Upgrade to `crypto-js >= 4.0.0`	Removes vulnerable behavior of the generator in subsequent operations.	The update does not make previously generated values stronger.
Replace generation with Web Crypto/Node crypto	Links secret generation to the OS or browser CSPRNG.	Fallback needs to be disabled on `Math.random()`.
Rotate historical secrets	Reduces risk to already issued keys, seeds, tokens, and IVs.	For wallets, this means a controlled transfer of assets to a new, securely generated seed.
Add SCA and entropy origin tests	Catches the reappearance of vulnerable code in the supply chain.	Check the actual call path, not just the CVE in SBOM.
Conduct forensics	Defines the generation time interval and the affected entities.	When there is evidence of theft, the priority is to preserve evidence and protect remaining assets.

10. Scientific conclusions

CVE-2026-71851 illustrates the difference between a “long random string” and cryptographic entropy. An array size of 16 or 32 bytes is not a proof of security: the distribution, size of the hidden state, quality of the seed, and the modelability of the generator are subject to evaluation.

For a cryptanalyst, this is a classic case of a reduction attack: there’s no point in breaking the subsequent algorithm if you can narrow its input space. For a security engineer, the practical criterion is simple: any material on which secrecy depends must originate from a CSPRNG; and if a flaw is discovered, historically generated secrets must also be considered potentially vulnerable.

Sources

Miggo Vulnerability Database – CVE-2026-71851: crypto-js Insufficient Entropy: https://dibix.ru/miggo-vulnerability-database-cve-2026-71851-crypto-js-insufficient-entropy/

Miggo Vulnerability Database. CVE-2026-71851: crypto-js Insufficient Entropy . Source file: miggo.io .
CVE Program. CVE-2026-71851 : cve.org .
GitLab Advisory Database. crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain : advisories.gitlab.com .
GitHub Advisory Database. GHSA-rg76-677x-56q9 (primary advisory, listed in the GitLab database).
BIP 39. Mnemonic code for generating deterministic keys : bitcoin/bips .