Insecure Cryptography Algorithm in simple-crypto-js
Summary
GHSA-5v7r-jg9r-vq44: Insecure Cryptography Algorithm in simple-crypto-js. Affects simple-crypto-js versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
simple-crypto-js is an npm package that provides cryptographic functions for JavaScript applications. It offers encryption and decryption capabilities using various algorithms. However, versions prior to 2.3.0 utilize the AES-CBC algorithm with PKCS#7 padding, which is susceptible to padding oracle attacks. This vulnerability may allow attackers to exploit the encryption and gain unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability in simple-crypto-js arises from the use of an insecure cryptography algorithm. AES-CBC with PKCS#7 padding is known to be vulnerable to padding oracle attacks. These attacks involve manipulating the padding of encrypted data to reveal information about the plaintext. As a result, an attacker could potentially decrypt the encrypted data and access sensitive information. This vulnerability poses a moderate risk to the security of applications utilizing simple-crypto-js.
How To Fix
Latest published version: 3.0.1 as of 23 Oct 2026
npm install simple-crypto-js@3.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
npm install simple-crypto-js@2.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in simple-crypto-js arises from the use of an insecure cryptography algorithm, AES-CBC with PKCS#7 padding. Upgrading to version 2.3.0 or later of the package is recommended to address this vulnerability. By updating, the encryption process becomes secure, mitigating the risk of unauthorized access to sensitive data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simple-crypto-js →
FAQ
simple-crypto-js is an npm package that provides cryptographic functions for JavaScript applications. It allows developers to encrypt and decrypt data using various algorithms.
AES-CBC (Advanced Encryption Standard - Cipher Block Chaining) is a symmetric encryption algorithm. PKCS#7 padding is a method used to fill the last block of plaintext before encryption. It ensures that the plaintext is a multiple of the block size. However, this combination of AES-CBC with PKCS#7 padding is vulnerable to padding oracle attacks.
Padding oracle attacks exploit vulnerabilities in the padding scheme of encrypted data. By manipulating the padding, an attacker can gain information about the plaintext and potentially decrypt the encrypted data.
The vulnerability in simple-crypto-js could allow attackers to decrypt encrypted data and access sensitive information. This could lead to unauthorized access, data breaches, and potential compromise of user data.
To mitigate the risk, it is crucial to update the simple-crypto-js package to version 2.3.0 or later. This ensures that the insecure cryptography algorithm is replaced with a secure one, preventing padding oracle attacks.
