Read the docs
TI-2023-24775 Aliases CVE-2023-46133GHSA-mpj8-q39x-wq5h

crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

Priority MEDIUM 48CWE-328Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 2.1.0 contains a patch for this issue. As a workaround, configure CryptoES to use SHA256 with at least 250,000 iterations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00541 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed crypto-es (entronad): 2.1.0crypto-es (npm): 2.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
entronadcrypto-esbefore 2.1.02.1.0Patch availableCNA
—crypto-es (npm)before 2.1.02.1.0Patch availableGHSA-mpj8-q39x-wq5h
  • crypto-es Vendorentronad Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA
  • crypto-es (npm) Vendor— Affected before 2.1.0 Fixed in 2.1.0 Patch available GHSA-mpj8-q39x-wq5h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:entronad:cryptoes:*:*:*:*:*:node.js:*:*before 2.1.0Vulnerableentronad
  • cpe:2.3:a:entronad:cryptoes:*:*:*:*:*:node.js:*:* Versions before 2.1.0 Vulnerable ·entronad

Remediation

  • Fix · CNA crypto-es (entronad) Fixed in 2.1.0
  • Fix · GHSA-mpj8-q39x-wq5h crypto-es (npm) Fixed in 2.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46133
  2. 2026-10-03 Alias added: GHSA-mpj8-q39x-wq5h

References

Exploit 1

Patch 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences