Skip to content
OpenAdvisories

Package · npm

elliptic

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical —
    GHSA-vjh7-7g9h-fjfh

    Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)

    ### Summary Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON network input Note that `elliptic` by design accepts hex strings as one of the possible input types ### D…

    elliptic npm
  • Critical 9.1
    CVE-2024-48949

    Elliptic's verify function omits uniqueness validation

    The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

    reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm