Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript

Description

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages.

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated.

Recommendation

Update the @aws-crypto/client-browser package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 2.0.0, < 2.2.0

  < 1.9.0**

• Patched version(s): **2.2.0

  1.9.0**

References

• GHSA-h45p-w933-jxh3
• CWE-347
• OWASP 2021-A2

Related Issues

• Sentry SDK Prototype Pollution gadget in JavaScript SDKs - Vulnerability
• BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability - CVE-2025-69287
• Improper Authorization in @sap-cloud-sdk/core - Vulnerability
• Improper Key Verification in ipns - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 2

SmartScanner 2.3: Smarter JavaScript Detection, Faster Scans, and Powerful CLI Enhancements

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

@aws-crypto/client-browser