Skip to main content
cve.nowby Sazabi
← npm
npmPackage

elliptic

8 known vulnerabilities (1 critical, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 1 critical, 6 medium
Registry
npm

Advisories 8

  • CVE-2025-14505Medium 5.6

    Elliptic Cryptanalysis vulnerability when `k` has leading zeros

    Affected: through 6.6.1; through 6.6.1.

  • CVE-2024-48948Medium 4.8

    The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains…

    Affected: fixed in 6.6.0.

  • CVE-2024-48949Critical 9.1

    The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n)…

    Affected: fixed in 6.5.6.

  • CVE-2024-42461Medium 5.3

    In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

    Affected: from 5.2.1, fixed in 6.5.7.

  • CVE-2024-42460Medium 5.3

    In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading…

    Affected: from 2.0.0, fixed in 6.5.7.

  • CVE-2024-42459Medium 5.3

    In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus…

    Affected: from 4.0.0, fixed in 6.5.7.

  • CVE-2020-28498Medium 6.8

    Cryptographic Issues

    Affected: fixed in 6.5.4.

  • The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer…

    Affected: fixed in 6.5.3.