StackPrism

npm package

crypto-js vulnerabilities by version

The latest release, 4.2.0 (Oct 24, 2023), has no known vulnerabilities. 8% of last week’s 19.2M downloads went to versions with known vulnerabilities. OSV.dev lists 3 advisories for crypto-js; the newest was published on Aug 7, 2026. The maintainers have deprecated crypto-js.

npm (opens in a new tab) describes it as “JavaScript library of crypto standards.”

Latest release
4.2.0
Oct 24, 2023, no known vulnerabilities
Downloads last week
19.2M
All versions, from npm
Advisories on OSV.dev
3
Newest Aug 7, 2026
Licence
MIT
OpenSSF Scorecard
2.2/10
brix/crypto-js (opens in a new tab)
Status
Deprecated
Active development of CryptoJS has been discontinued. This library is no longer maintained.

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
4.2.0latestOct 24, 2023Deprecated release17.6M
4.1.1Jul 22, 20211 known vulnerability, worst rated criticalDeprecated946.6K
3.3.0Feb 12, 20202 known vulnerabilities, worst rated criticalDeprecated391.9K
4.0.0Feb 12, 20201 known vulnerability, worst rated criticalDeprecated96.5K
3.1.9-1Dec 14, 20162 known vulnerabilities, worst rated criticalDeprecated91.9K
3.2.1Feb 11, 20202 known vulnerabilities, worst rated criticalDeprecated72.4K
3.1.8Oct 27, 20162 known vulnerabilities, worst rated criticalDeprecated45.5K
3.1.6Jan 4, 20162 known vulnerabilities, worst rated criticalDeprecated3.6K

Who is still on a vulnerable crypto-js

8% of last week’s 19.2M crypto-js downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. crypto-js doesn’t publish support dates we can check.

LineNewest releaseReleased
44.2.0Oct 24, 2023
33.3.0Feb 12, 2020

Newest advisories

The 3 most recently published, with the versions each one affects.

  1. CriticalCVE-2026-71851 on OSV.dev (opens in a new tab)GHSA-rg76-677x-56q9

    crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

    Affects < 4.0.0. Published Aug 7, 2026.

  2. CriticalCVE-2023-46233 on OSV.dev (opens in a new tab)GHSA-xwcq-pm8m-c4vf

    crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

    Affects < 4.2.0. Published Oct 25, 2023.

  3. WarningCVE-2020-36732 on OSV.dev (opens in a new tab)GHSA-3w3w-pxmm-2w2j

    crypto-js uses insecure random numbers

    Affects >= 3.2.0, < 3.2.1. Published Jun 12, 2023.

Which crypto-js do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for crypto-js, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.