CVE-2026-71851 brix CVE debrief

Who should care

Defenders responsible for applications using crypto-js, especially those involving BIP39 recovery phrases, should assess exposure to potential private key recovery attacks and prioritize updating to version 4.0.0 or later.

Why it matters

CVE-2026-71851 allows potential private key recovery due to weak randomness generation in crypto-js, affecting applications using BIP39 recovery phrases. Defenders should verify crypto-js usage, assess exposure, and update to version 4.0.0 or later.

• Potential private key recovery attacks against BIP39 recovery phrases.
• Enumeration of reduced output space on commodity hardware.
• Verification of crypto-js version and usage in applications.
• Monitoring for potential exploitation attempts.

Technical summary

The crypto-js library, prior to version 4.0.0, uses a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), to generate randomness. This results in a reduced output space that can be enumerated on commodity hardware, potentially allowing an attacker to recover private keys used for BIP39 recovery phrases. The generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.

Defensive priority

Defenders should prioritize verifying the use of crypto-js in their applications, especially those involving BIP39 recovery phrases, and assess exposure to potential private key recovery attacks.

Recommended defensive actions

• Verify the use of crypto-js in applications, especially those involving BIP39 recovery phrases.
• Assess exposure to potential private key recovery attacks.
• Update to version 4.0.0 or later of crypto-js.
• Monitor for potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in crypto-js, which generates randomness using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(). This results in a reduced output space that can be enumerated on commodity hardware, potentially allowing an attacker to recover private keys used for BIP39 recovery phrases.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.