AIKIDO-2025-10315
@uppy/companion is vulnerable to AES Key Wear-out
30
Low Risk
This Affects:
@uppy/companionTL;DR
Using the same encryption key to encrypt an unlimited amount of data/documents results in key wear-out, in particular when using AES-CBC or other cipher modes that are not very resistant to nonce misuse. The patch version derives from the application secret a fresh encryption key and a fresh initialization vector for every document to encrypt. HKDF is used to derive these values and the context info parameter is set to a fresh random value called nonce. This nonce replaces the IV in the token.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@uppy/companion is vulnerable to AES Key Wear-out in versions 0.0.1 - 5.6.0.
How to fix this
Upgrade the @uppy/companion library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant