All rules →
Rules / JavaScript / TypeScript
SHIELD-JS-021

Weak hash (MD5) used for a security value

highJavaScript / TypeScriptCWE-916CVSS 7.4

What it detects

MD5 is fast and broken; deriving a token/password/reset value from it (e.g. token == md5(login)) enables brute force and collisions leading to account takeover.

How to fix

Use a slow salted KDF (bcrypt/scrypt/argon2) for credentials and crypto.randomBytes for tokens; never MD5.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-021: Weak hash (MD5) used for a security value — Zennoxa Shield