{"action":"Upgrade crypto-js to 4.0.0 or later.","affected":[{"fixed":"4.0.0","introduced":"0"}],"component":"crypto-js","cve_ids":["CVE-2026-71851"],"ecosystem":"npm","epss":0.0055,"exploited":false,"fixed_versions":["4.0.0"],"ghsa_id":"GHSA-rg76-677x-56q9","id":"tcs_01M5KG90A23AC9R783JEDR9CNH","modified_at":"2026-08-07T19:10:56.177489Z","published_at":"2026-08-07T18:48:59Z","references":["https://osv.dev/vulnerability/GHSA-rg76-677x-56q9","https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9","https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5","https://github.com/brix/crypto-js","https://www.coinspect.com/blog/ill-bloom-investigation"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-rg76-677x-56q9","url":"https://osv.dev/vulnerability/GHSA-rg76-677x-56q9"}],"summary":"crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain"}