Weak RSA key size (ARCH3117)

Key typescript.security.weak-rsa-key-size · Severity warning · Category security · CWE CWE-326

Generating an RSA/DSA key below 2048 bits is no longer considered secure and is exposed to factoring attacks given modern compute.

Incorrect

import { generateKeyPairSync } from "crypto";

const { privateKey } = generateKeyPairSync("rsa", {
  modulusLength: 1024, // too weak
});

Correct

import { generateKeyPairSync } from "crypto";

const { privateKey } = generateKeyPairSync("rsa", {
  modulusLength: 2048, // at least 2048
});

Fix

Generate RSA keys with at least 2048 bits (preferably 3072+).