Static IV (ARCH3114)

Key typescript.security.static-iv · Severity error · Category security · CWE CWE-329

Passing a constant or zero IV/nonce to a cipher destroys semantic security across messages encrypted with the same key and breaks CBC/CTR/GCM modes.

Incorrect

import { createCipheriv } from "crypto";

const iv = Buffer.alloc(16, 0); // static zero IV
const cipher = createCipheriv("aes-256-cbc", key, iv);

Correct

import { createCipheriv, randomBytes } from "crypto";

const iv = randomBytes(16); // unique per encryption
const cipher = createCipheriv("aes-256-cbc", key, iv);
// store the iv alongside the ciphertext

Fix

Generate a random, unique IV with randomBytes for every encryption operation.