# Usage of weak hashing library (MD5)

## Overview

* **Rule ID**: `javascript_lang_weak_hash_md5`
* **Applicable Languages**: Javascript
* **Weakness ID**: CWE-328

## Description

Using a weak hashing library such as MD5 heightens the risk of data breaches. MD5 is susceptible to collision attacks, where different inputs generate the same output, compromising data integrity and security.

## Remediation Guidelines

* **Avoid using MD5** for hashing or security purposes, as it is no longer deemed secure for cryptographic applications.
*   **Choose more robust hashing algorithms**, such as SHA-256, for improved security.

    ```javascript
    const crypto = require("crypto");

    const key = "secret key";
    const hash = crypto.createHmac("sha256", key).update(user.password).digest('hex');
    ```

## References

* [**NodeJS Crypto Module**](https://nodejs.org/api/crypto.html)
* [**CWE-328: Use of Weak Hash**](https://cwe.mitre.org/data/definitions/328.html)
* [**OWASP Top 10: A02:2021 - Cryptographic Failures**](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)
