Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-021

Weak hash (MD5) used for a security value

highJavaScript / TypeScriptCWE-916CVSS 7.4

What it detects

MD5 is fast and broken; deriving a token/password/reset value from it (e.g. token == md5(login)) enables brute force and collisions leading to account takeover.

How to fix

Use a slow salted KDF (bcrypt/scrypt/argon2) for credentials and crypto.randomBytes for tokens; never MD5.

Vulnerable — Shield flags thistoken.js
const crypto = require('crypto');

function makeResetToken(login) {
  const token = crypto.createHash('md5').update(login).digest('hex');
  return token;
}

module.exports = makeResetToken;
Fixed — scans cleantoken.js
const crypto = require('crypto');

function makeResetToken(login) {
  const token = crypto.randomBytes(32).toString('hex');
  return token;
}

module.exports = makeResetToken;

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-021, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-021: Weak hash (MD5) used for a security value — Zennoxa Shield