Skip to content
OpenAdvisories
High · 7.5 CVE-2022-41340 EUVD-2022-6905GHSA-q3f4-9h4p-vgr3

secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery

Published Sep 24, 2022 · Updated May 22, 2025 · Assigned by mitre

Package: @lionello/secp256k1-js Ecosystem: npm

Description

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.

Affected packages

EcosystemPackageAffectedFixedRecord
npm @lionello/secp256k1-js < 1.1.0 1.1.0 GHSA-q3f4-9h4p-vgr3

References