Weak KDF iterations (ARCH3116)

Key typescript.security.weak-kdf-iterations · Severity warning · Category security · CWE CWE-916

Using a password key-derivation function with too-low iteration/cost, or a fast hash for password storage, weakens resistance to brute-force attacks.

Incorrect

import { pbkdf2Sync } from "crypto";

// 1000 iterations is far too low for modern hardware
const hash = pbkdf2Sync(password, salt, 1000, 32, "sha256");

Correct

import { pbkdf2Sync } from "crypto";

// OWASP guidance: at least 600,000 iterations for SHA-256
const hash = pbkdf2Sync(password, salt, 600_000, 32, "sha256");

Fix

Use a current recommended iteration count, or prefer password-specific KDFs like bcrypt/scrypt/Argon2.