AIKIDO-2025-10315
@uppy/companion is vulnerable to AES Key Wear-out
30
Low Risk
This Affects:
@uppy/companionTL;DR
Using the same encryption key to encrypt an unlimited amount of data/documents results in key wear-out, in particular when using AES-CBC or other cipher modes that are not very resistant to nonce misuse. The patch version derives from the application secret a fresh encryption key and a fresh initialization vector for every document to encrypt. HKDF is used to derive these values and the context info parameter is set to a fresh random value called nonce. This nonce replaces the IV in the token.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@uppy/companion is vulnerable to AES Key Wear-out in versions 0.0.1 - 5.6.0.
How to fix this
Upgrade the @uppy/companion library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.