Skip to content
OpenAdvisories

Package · npm

tiny-secp256k1

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.1
    CVE-2024-49364

    tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment

    tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require('buffer') is …

    bitcoinjs tiny-secp256k1 tiny-secp256k1 npm
  • High 8.1
    CVE-2024-49365

    tiny-secp256k1 allows for verify() bypass when running in bundled environment

    tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM b…

    bitcoinjs tiny-secp256k1 tiny-secp256k1 npm