https://seclists.org/oss-sec/2026/q1/185: Default IV & other issues in aes-js & pyaes modules, & strongMan VPN manager
Published Feb 19, 2026
·Updated
Affected Software
3 affected components
npm/aes-js
pypi/pyaes
strongSwan strongMan
Frequently Asked Questions
1
What is the severity of CVE-2026-XXXX related to aes-js and pyaes modules?
The severity of CVE-2026-XXXX is considered high due to the potential for key and IV reuse, which can lead to serious cryptographic vulnerabilities.
2
How do I fix CVE-2026-XXXX in the aes-js and pyaes modules?
To fix CVE-2026-XXXX, update to the latest versions of aes-js and pyaes that address the default IV issue.
3
What are the implications of CVE-2026-XXXX for applications using strongMan VPN?
Applications using strongMan VPN and the affected libraries are at risk of cryptographic vulnerabilities that could expose sensitive data.
4
What caused the vulnerability CVE-2026-XXXX in aes-js and pyaes?
CVE-2026-XXXX was caused by the libraries providing a default initialization vector (IV) in their encryption APIs.
5
Are there known exploits for CVE-2026-XXXX?
As of now, there are no publicly reported exploits specifically targeting CVE-2026-XXXX, but the potential for abuse exists due to key/IV reuse.