Skip to main content
cve.nowby Sazabi
Menu
npm

Package

create-ecdh

1 known CVE (1 high), with the versions each affects and the releases that fix them.

npm

Latest release
4.0.5 (Nov 14, 2026): no advisory affects it
Newest unaffected release
4.0.5 (Nov 14, 2026), the latest release
Downloads on affected versions
100% of create-ecdh downloads last week (12.4M of 12.4M) were on a version affected by at least one advisory
Weekly downloads
12.4M
Releases
14 since 1.0.0 (Nov 6, 2014)
Registry
npm
Releases read
Nov 14, 2026
Downloads read
Nov 14, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

  • create-ecdh: computeSecret does not validate that the peer public key is on the curve (invalid-curve attack)

    Affected: fixed in 4.0.5.

    Fixed in 4.0.5 (released Nov 14, 2026, the day of disclosure).

    The latest release, 4.0.5, is not affected.

    100% of create-ecdh downloads last week were affected versions (12.4M).