# Weak Hash vulnerability discovered in crypto-js and crypto-es (CVE-2023-46233 & CVE-2023-46133)

DevFeed: [Weak Hash vulnerability discovered in crypto-js and crypto-es (CVE-2023-46233 & CVE-2023-46133)](<https://devfeed.tech/articles/weak-hash-vulnerability-discovered-in-crypto-js-and-crypto-es-cve-2023-46233-cve-2023-46133-8231.md>)

Original publisher: [Read original article](<https://snyk.io/blog/weak-hash-vulnerability-crypto-js-crypto-es/>)

Author: Jamie Smith

Published: 2023-10-25T18:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Library](<https://devfeed.tech/topics/library.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [passwords](<https://devfeed.tech/topics/passwords.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [crypto](<https://devfeed.tech/tags/crypto.md>), [cve](<https://devfeed.tech/tags/cve.md>), [developer](<https://devfeed.tech/tags/developer.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [js](<https://devfeed.tech/tags/js.md>), [library](<https://devfeed.tech/tags/library.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [pmm](<https://devfeed.tech/tags/pmm.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-container](<https://devfeed.tech/tags/snyk-container.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

The article reports a Use of Weak Hash vulnerability affecting all previous versions of the discontinued crypto-js JavaScript library and the crypto-es package. The issue involves insecure SHA1 settings and an iteration count of 1, enabling brute-force attacks against hashed data such as stored passwords and signatures. Updated versions 2.1.0 and 4.2.0 raise the default iteration count to 250000, although the article recommends considering alternatives because crypto-js is not normally maintained.

## Source excerpt

Learn how to find and fix the new "Use of Weak Hash" vulnerability in crypto-js and crypto-es that was reported on October 18, 2023.