Skip to content
OpenAdvisories

Package · npm

sjcl

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.5
    CVE-2026-4258

    sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey

    Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-…

    sjcl npm