Description
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
Recommendation
Update the elliptic package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.2.1, <= 6.5.6
- Patched version(s): 6.5.7
References
Related Issues
- Valid ECDSA signatures erroneously rejected in Elliptic - CVE-2024-48948
- Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server - CVE-2024-11023
- Elliptic's verify function omits uniqueness validation - CVE-2024-48949
- Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
You might also like:
- Tags:
- npm
- elliptic
Anything's wrong? Let us know Last updated on November 04, 2025