Weak Randomness in WebCrypto Keygen in Node.js

CVE-2022-35255

What is CVE-2022-35255?

A vulnerability exists in Node.js 18 due to inadequate randomness in the WebCrypto key generation process. The issue stems from a failure to properly handle the return value of EntropySource(), which may not always succeed and can result in weak randomness. This can lead to cryptographic keys that are not sufficiently strong for secure operations, posing risks for applications relying on reliable key generation for encryption.

References