Description
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
Recommendation
Update the elliptic package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.2.1, <= 6.5.6
- Patched version(s): 6.5.7
References
Related Issues
- Valid ECDSA signatures erroneously rejected in Elliptic - CVE-2024-48948
- Pug allows JavaScript code execution if an application accepts untrusted input - CVE-2024-36361
- AngularJS allows attackers to bypass common image source restrictions - CVE-2024-8372
- Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes - CVE-2024-47061
You might also like:
- Tags:
- npm
- elliptic
Anything's wrong? Let us know Last updated on November 04, 2025