mscdex/ssh2

Scanned on May 13, 2026

Risk score/ 100

Critical risk

Summary

The ssh2 library contains 22 critical and 53 high-severity post-quantum cryptography vulnerabilities across 9 files. Core cryptographic protocols rely on quantum-vulnerable algorithms including RSA-2048, ECDSA, SHA-1 based key exchange, and legacy ciphers that will be broken by quantum computers. Immediate migration planning is required for regulatory compliance and long-term security.

Critical

High

Medium

Low

Top findings

CriticalMD5
lib/protocol/constants.js:143
SHA3-256 or SHA-256
Raw evidence
```
'hmac-md5-96',      // first 96 bits of HMAC-MD5
```

CriticalRSA key ≤ 2048 bits

test/test-keygen.js:31

Raw evidence

{ args: ['rsa', { bits: 2048, comment: 'foobarbaz' }], sshType: 'ssh-rsa' },

CriticalNullCipher
test/test-protocol-crypto.js:54
Raw evidence
```
cipher = new NullCipher(1, onCipherData);
```
CriticalSHA-1
lib/protocol/constants.js:132
SHA-256 or SHA3-256
Raw evidence
```
'hmac-sha1-etm@openssh.com',
```
CriticalNullCipher
test/test-protocol-crypto.js:10
Raw evidence
```
NullCipher,
```

+ 77 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan