crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-71851 · Microsoft / collected KEV context

GHSA-rg76-677x-56q9

cve-program · CVE-2026-71851

• https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9
• https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5
• https://www.coinspect.com/blog/ill-bloom-investigation

nvd · CVE-2026-71851

• https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5
• https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9
• https://www.coinspect.com/blog/ill-bloom-investigation

osv · GHSA-rg76-677x-56q9

• https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9
• https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5
• https://github.com/brix/crypto-js
• https://www.coinspect.com/blog/ill-bloom-investigation

No related operational record is retained in the current change model.