Description
The Elliptic package 6.5.5 for Node.js for EDDSA implementation does not perform the required check if the signature proof(s) is within the bounds of the order n of the base point of the elliptic curve, leading to signature malleability. Namely, the verify function in lib/elliptic/eddsa/index.js omits sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg() validation.
Recommendation
Update the elliptic package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.5.6
- Patched version(s): 6.5.6
References
Could your website be exposed too?
SmartScanner can check your website for Elliptic's verify function omits uniqueness validation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function - CVE-2024-9506
- Prototype pollution in ag-grid-community via the _.mergeDeep function - ag-grid-enterprise - CVE-2024-38996
- Elliptic's EDDSA missing signature length check - CVE-2024-42459
- akbr patch-into was discovered to contain a prototype pollution via the function patchInto - CVE-2024-38991
You might also like:
See something that needs correcting? Let us knowUpdated November 27, 2025