openssl_encrypt npm Package Vulnerability: Critical Arbitrary Code Execution
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- openssl_encrypt (npm)
- Patched version
- 1.4.0
The openssl_encrypt npm package versions before 1.4.0 have been confirmed to contain a critical vulnerability that allows arbitrary code execution. Users of these versions are at risk.
What happened
The openssl_encrypt npm package versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation. Attackers can exploit this by placing malicious .so files in site-packages directories, leading to native code execution when the module is loaded. This vulnerability has been tracked under CVE-2026-74872 and has a CVSS score of 9.8, indicating a critical severity level.
Additional vulnerabilities have been identified in the same package versions, including bypassing JSON schema validation (CVE-2026-74875) and creating key bundles from untrusted data without verifying signatures (CVE-2026-74876). These vulnerabilities also have a CVSS score of 9.8, highlighting the critical nature of the issue.
What to do about it
- Upgrade to openssl_encrypt@1.4.0 or later to mitigate the risk of arbitrary code execution.
- Review your project dependencies to ensure all instances of openssl_encrypt are updated to the patched version.
- Monitor the primary sources for any further updates or additional vulnerabilities that may be discovered.
How 0Day would have caught this
openssl_encrypt is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using openssl_encrypt npm package versions before 1.4.0.
What should I do right now?
Upgrade to openssl_encrypt@1.4.0 or later immediately to mitigate the risk.
Are there any known exploits in the wild?
No, this vulnerability has not been exploited in the wild according to the provided data.
Where can I find more information about this vulnerability?
Consult the primary sources listed in the threat data for detailed information and updates.